Enabling FIPS
Enabling FIPS on RLC Pro is a two-part process: install the CIQ validated FIPS packages, then turn on FIPS mode. FIPS packages are not installed on standard RLC images by default, and the upstream Rocky Linux modules are not covered by CIQ's certificates.
CIQ delivers these packages through a metapackage. A metapackage installs no software of its own; it simply lists a group of packages that belong together, so a single dnf install pulls in CIQ's complete set of validated FIPS packages in one step. It also keeps that set locked, so a later system update cannot quietly replace the FIPS builds with non-FIPS versions. (Under the hood, the metapackage requires the ciq-fips-* capabilities that only CIQ's FIPS packages provide.)
Choose the tier that matches your requirement:
FIPS Compliant is the right choice for almost every deployment. It uses the same cryptographic code as the lab-validated (certified) modules, so you get FIPS-approved cryptography, and CIQ continues to backport CVE fixes to the non-cryptographic parts of the packages. You keep receiving security updates over the life of the release without altering the validated cryptographic implementation.
Enable the CIQ FIPS Compliant repository and install the compliant metapackage:
sudo depot enable fips-9.6-compliant
sudo dnf install rlc-fips
FIPS Certified uses the exact package versions that the accredited lab validated and that appear on the NIST CMVP certificate. Choose it only when a specific requirement forces you to run that precise build, such as an auditor, contract, or accreditation that cites a particular certificate number.
Certified versions are frozen: they receive no updates of any kind, including CVE security fixes, until a newer build completes validation. Running Certified means accepting the risk of unpatched packages in exchange for exact certificate traceability.
For 9.6 and later the certified packages come from the same fips-9.6-compliant repository, via the rlc-fips-certified metapackage:
sudo depot enable fips-9.6-compliant
sudo dnf install rlc-fips-certified
Certified packages stay frozen and receive no security updates. Prefer Compliant unless a certificate must be cited, and contact CIQ Support before deploying Certified.
The rlc-fips and rlc-fips-certified metapackages conflict, so install only one. The Depot channel name is minor-release specific: use fips-<minor>-compliant to match your RLC Pro minor version (for example, fips-9.6-compliant on 9.6). For moving between tiers, see Switching FIPS Modes, a RLC Pro Hardened guide whose example commands also install the Hardened rlc-h meta; base RLC Pro systems omit rlc-h.
Once the FIPS packages are installed, enable FIPS mode:
- RLC Pro 8.x and 9.x (EL8/EL9): run
sudo fips-mode-setup --enable, then reboot. - RLC Pro 10 (EL10): FIPS can be enabled only at installation time. The
fips-mode-setuptool has been removed on EL10, and switching a running system to FIPS mode is not supported. To stop using FIPS mode, reinstall the system without it.
Verify FIPS mode with cat /proc/sys/crypto/fips_enabled (returns 1) and update-crypto-policies --show (returns FIPS).
The FIPS-enabled RLC Pro Hardened image variant ships with these packages installed and FIPS mode on. On standard images and base RLC Pro systems, follow the steps above.
For step-by-step EL8/EL9 enablement, verification, and troubleshooting, see Enabling FIPS Mode on RLC Pro Hardened.