Switching FIPS Modes (Compliant and Certified)
RLC Pro supports two mutually exclusive FIPS enforcement modes, each delivered by a meta package:
| Mode | Meta package | Behavior |
|---|---|---|
| Compliant | rlc-fips | Floating FIPS packages that update automatically as new FIPS builds are published. |
| Certified | rlc-fips-certified | Version-pinned FIPS packages locked to a specific certified set; no automatic updates. |
rlc-fips and rlc-fips-certified conflict, so only one can be installed at a time. Neither installs automatically; each must be installed explicitly.
For the difference between FIPS Certified and FIPS Compliant as compliance states, see the FIPS compliance model.
How enforcement works
CIQ's FIPS packages (openssl, gnutls, nss, libgcrypt, and others) are override packages: they replace the base OS builds but are not the highest version (EVR) in the combined repository stack. Because DNF selects the highest EVR across all enabled repositories, dnf install openssl on its own returns the base OS build, not the FIPS build.
The meta package is the gatekeeper. It carries Requires: ciq-fips-<package> dependencies on virtual provides that exist only in CIQ FIPS builds and cannot be satisfied by base OS or LTS packages. This forces DNF to select the FIPS packages. There is no supported path to the FIPS builds without the meta.
Installing a FIPS meta package puts the correct crypto packages in place but does not enable kernel FIPS enforcement. FIPS mode is a separate step that requires a reboot; see Enabling FIPS Mode. Without it, the FIPS packages are installed but the kernel is not enforcing FIPS mode.
Installing a mode
Install one FIPS metapackage, then enable FIPS mode. Choose the tier:
rlc-h in these commands is the separate hardened metapackage (hardened glibc and openssh), installed alongside FIPS on RLC Pro Hardened. It is not part of FIPS; see Hardened Package Enforcement. On base RLC Pro (non-Hardened) systems, omit rlc-h and install only the FIPS metapackage.
The Depot channel name is minor-release specific: use fips-<minor>-compliant to match the running RLC Pro minor version (for example, fips-9.6-compliant on 9.6).
Enable the FIPS repository, install the compliant meta, then enable FIPS mode:
sudo depot enable fips-9.6-compliant
sudo dnf install rlc-fips # add "rlc-h" too on RLC Pro Hardened
sudo fips-mode-setup --enable
sudo reboot
Verify after reboot:
dnf list installed rlc-fips
rpm -q gnutls openssl nss-softokn-freebl libgcrypt
sudo fips-mode-setup --check
While rlc-fips remains installed, DNF keeps future upgrades on the FIPS builds.
The certified meta pins an exact set of package versions, including a specific kernel, and installs python3-dnf-plugin-versionlock with dnf versionlock entries so a plain dnf upgrade skips the pinned packages rather than failing. For 9.6 and later there is no separate certified repository; both metapackages come from the fips-9.6-compliant repo.
sudo depot enable fips-9.6-compliant
sudo dnf install rlc-fips-certified # add "rlc-h" too on RLC Pro Hardened
sudo fips-mode-setup --enable
sudo reboot
Verify after reboot, confirming the kernel matches the certified version:
dnf list installed rlc-fips-certified
uname -r
rpm -q openssl gnutls nettle gmp nspr nss nss-util nss-softokn nss-softokn-freebl libgcrypt openssl-fips-provider openssl-fips-provider-so
sudo fips-mode-setup --check
Install the certified meta on a fresh system. Compliant packages carry a permanently higher Epoch (2) on some packages (for example, nss) than the certified builds, so dnf swap from compliant to certified is not supported; Epoch dominance cannot be reversed by a swap. FIPS mode enabled against a kernel that does not match the certified version is not a valid certified configuration; always reboot and confirm uname -r.
For the authoritative list of certified package versions per certification cycle, see the module certification status or contact CIQ Support.
Switching modes
Certified to Compliant
Move from pinned certified packages to floating FIPS updates:
sudo dnf swap rlc-fips-certified rlc-fips
sudo dnf upgrade
The swap removes the versionlock entries and DNF upgrades the formerly pinned packages to the current compliant builds. Verify with dnf list installed rlc-fips.
Compliant to Certified
This requires a fresh system. Compliant packages already carry a permanently higher Epoch on the affected packages, which dnf swap cannot downgrade. Provision a fresh RLC Pro Hardened system and follow the certified-mode steps above.
Opting out of FIPS enforcement
Removing the meta package removes FIPS enforcement. This is a deliberate, breaking action: on the next dnf upgrade, base OS or LTS packages replace the FIPS builds.
sudo dnf remove rlc-fips
# or
sudo dnf remove rlc-fips-certified
Troubleshooting
Version mismatch after a certified install
If rpm -q shows a package version that does not match the certified version after installing rlc-fips-certified, DNF may have skipped a downgrade due to a held package or dependency conflict. Run:
sudo dnf distro-sync
If the conflict persists, identify what is holding the newer version:
dnf repoquery --installed --whatprovides gnutls
Contact CIQ Support if dnf distro-sync cannot resolve the conflict.
dnf swap fails with a dependency error
If dnf swap exits with unresolved dependency errors, a third-party package may depend on a specific version of a FIPS package. Review the error to identify the conflicting package, then remove or update it before retrying the swap. Contact CIQ Support if the conflict cannot be resolved without removing critical third-party packages.