As I understand it, if you want to be FIPS-compliant you have to use FIPS-certified components. My question is how different can your use of the component by from what's on the component's validation certificate be for you to still be using a FIPS-certified component?
For example, here's a validation certificate for NSS: http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140crt/140crt1280.pdf
The certificate says the NSS software version is 3.12.4 and was tested on RHELv5 on an IBM System x3550 and on a HP ProLiant DL 145.
I assume (?) that I definitely need to use version NSS 3.12.4 since that is the version that certificate says was validated. (For the moment I'm ignoring the possible existence of later certified versions of NSS -- pretend this one is the latest one if it's not).
But what about the operating system and server hardware? If I run NSS 3.12.4 in an Ubuntu installation am I still considered to be using a FIPS-certified component? What if I run it on RHELv5 but on hardware different from what was mentioned on the validation certificate?
I'll try to be clearer/more explicit...
Is NSS 3.12.4 considered validated/certified when run on any operating system or only when run on RHELv5? And how does one determine the answer to that question?