NGINX must be configured to use a FIPS-validated cryptographic module for confidentiality and integrity.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-278407	SRG-APP-000630	NGNX-APP-002660	SV-278407r1172754_rule	2026-01-07	1

Description
FIPS 140-2/140-3 precludes using invalidated cryptography for the cryptographic protection of sensitive or valuable data within federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2/140-3 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2/140-3 standard. The cryptographic module used must have at least one validated digital signature function. This validated hash algorithm must be used to generate digital signatures for all cryptographic security function within the product being evaluated. Satisfies: SRG-APP-000630, SRG-APP-000635

Description

FIPS 140-2/140-3 precludes using invalidated cryptography for the cryptographic protection of sensitive or valuable data within federal systems. Unvalidated cryptography is viewed by NIST as providing no protection to the information or data. In effect, the data would be considered unprotected plaintext. If the agency specifies that the information or data be cryptographically protected, then FIPS 140-2/140-3 is applicable. In essence, if cryptography is required, it must be validated. Cryptographic modules that have been approved for classified use may be used in lieu of modules that have been validated against the FIPS 140-2/140-3 standard. The cryptographic module used must have at least one validated digital signature function. This validated hash algorithm must be used to generate digital signatures for all cryptographic security function within the product being evaluated. Satisfies: SRG-APP-000630, SRG-APP-000635

ℹ️ Check
Verify NGINX is using OpenSSL with FIPS enabled. For version 1.x: # nginx -V nginx version: nginx/1.15.2 (nginx-plus-r16) built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017" If the response does not include "fips" in the OpenSSL version, this is a finding. For version 3.x: # openssl list -providers Providers: base name: OpenSSL Base Provider version: 3.2.2 status: active default name: OpenSSL Default Provider version: 3.2.2 status: active fips name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider version: 3.2.2-622cc79c634cbbef status: active If the response does not list a FIPS provider with a status of "active", this is a finding.

ℹ️ Check

Verify NGINX is using OpenSSL with FIPS enabled. For version 1.x: # nginx -V nginx version: nginx/1.15.2 (nginx-plus-r16) built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) built with OpenSSL 1.0.2k-fips 26 Jan 2017" If the response does not include "fips" in the OpenSSL version, this is a finding. For version 3.x: # openssl list -providers Providers: base name: OpenSSL Base Provider version: 3.2.2 status: active default name: OpenSSL Default Provider version: 3.2.2 status: active fips name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider version: 3.2.2-622cc79c634cbbef status: active If the response does not list a FIPS provider with a status of "active", this is a finding.

✔️ Fix
FIPS must be enabled on the operating system. Follow the OS guidelines for installing FIPS mode. After installation, confirm that FIPS is enabled: # sudo sysctl –a \| grep fips crypto.fips_enabled = 1 Install the FIPS-validated version of OpenSSL to the operating system.