New answers tagged


When based on a standard, especially those as stringent as FIPS 140-2, you have to go through the following processes (which are time consuming and expensive): Design Testing Certification If you take a look at the NIST Implementation Guide for FIPS PUB 140-2, along with the other documents, you can search for the Level 4 implementation which detail that ...


I'm a FIPS tester and confirm that indeed overall level 1 means it is validated at FIPS 140-2 level 1. Different sections can be tested and validated at different levels (1-4) however the overall level defaults to the section validated at the lowest level.


There is a FIPSMode configuration option in Tomcat's APR Lifecycle Listener, which looks like it would fulfill your requirements. As observed in this very similar StackOverflow thread, and Tomcat/APR Lifecycle Listener documentation, it's really about the operating mode of OpenSSL, not Tomcat. On a not-unrelated note, Tomcat isn't FIPS-certified, due to the ...

Top 50 recent answers are included