Update FIPS ingest docs for native Go FIPS 140-3 by macdewee · Pull Request #7818 · elastic/docs-content

macdewee · 2026-08-06T08:54:51Z

Summary

Updates the FIPS ingest documentation from the previous BoringCrypto/CGo-based FIPS 140-2 implementation to the current native Go FIPS 140-3 module (GOFIPS140=v1.0.0, CMVP Certificate #5247). The native Go module changes the compliance model from "component excluded entirely from FIPS builds" to "component available with specific configurations not supported."

Key changes:

Framing updated from "FIPS 140-2 compliant" to "FIPS 140-3 capable" throughout; CMVP certificate reference added.
New section: Elastic Agent in OpenTelemetry mode (EDOT) — removes the "OTel mode not yet supported" statement and documents actual limitations: Azure PKCS#12 cert auth, Kafka SCRAM, MongoDB/MySQL/SQL Server receivers not supported, Kerberos for beat receivers, API key auth extension, and GPG upgrade verification.
Elastic Integrations list scoped explicitly to Fleet-managed integrations with cross-reference to the EDOT section, resolving the apparent contradiction between the two sections for Azure.
TLS section updated to FIPS 140-3, minimum RSA key length added, Kerberos section scoped to avoid ambiguity with EDOT.
Process language cleaned up throughout ("not yet supported", "currently not supported", "not supported for now").

Pre-publish checklist:

Confirm reason Elastic Defend appears in the incompatible integrations list
Confirm APM Server section is complete (single limitation: Secrets Keystore)

Generative AI disclosure

Did you use a generative AI (GenAI) tool to assist in creating this contribution?

Yes

Tool(s) and model(s) used: Claude Sonnet 4.6 (Claude Code)

- Update framing from FIPS 140-2 (BoringCrypto) to FIPS 140-3 capable with Go's native FIPS module (GOFIPS140=v1.0.0, CMVP cert #5247) - Add EDOT (OpenTelemetry mode) limitations section covering Azure, Kafka, MongoDB, MySQL, SQL Server, Kerberos, API key auth, and GPG upgrade verification - Add sections for Auditbeat, Heartbeat, Packetbeat, and Winlogbeat (single limitation each: Azure/AWS PKCS#12 cert auth not supported) - Remove "OpenTelemetry mode not yet supported" — EDOT is now supported with documented limitations - Scope Fleet-managed integrations list explicitly; cross-reference EDOT - Clean up process language throughout (not yet, currently, for now) - Add TLS minimum key length and scope Kerberos section explicitly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions · 2026-08-06T08:55:32Z

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

github-actions · 2026-08-06T08:56:32Z

🔍 Preview links for changed docs

deploy-manage/security/fips-ingest.md

github-actions · 2026-08-06T08:56:33Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

shainaraskas

in what stack version do we become fips 140-3 compliant? this doc applies to all 9.x versions of the product, so I think we need to rethink how we're editing it so it serves all of our audiences.

adding ski docs as well because they have more ingest context

shainaraskas · 2026-08-06T17:05:16Z

spare key here - we need to delete these lines

applies_to: deployment: ga

shainaraskas · 2026-08-06T17:05:32Z

this needs to be populated (I realize this was before your edits)

nastasha-solomon · 2026-08-06T17:39:17Z

- linking against a FIPS certified cryptographic library
- using only FIPS approved cryptographic functions
- ensuring that the configuration of the component is FIPS 140-2 compliant.
+{{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, and {{apm-server}} are FIPS 140-3 capable. They use Go's native FIPS 140-3 module (`GOFIPS140=v1.0.0`, CMVP Certificate [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)) for cryptographic operations. Specific components and configurations that fall outside the certified boundary are documented in the limitations sections below.


It's been a while since I've seen docs about FIPs, so take my suggestions with a grain of salt. From what I recall, FIPs-capable services or applications are slightly different from FIPs-compatible ones:

FIPS capable: Underlying architecture supports FIPS encryption standards, but the service/app is not federally certified.

FIPS compatible: Service/app can communicate with FIPS systems but might not be using FIPS encryption.

I've also seen these terms used interchangeably, so this might be a nitpicky observation on my part. Just wanted to raise this in case it really is something that needs to be consistent across these docs.

I think it is very grey area and I took stricter/safer approach here, but the true is that our fips compliance depends a lot on configuration and set of the components being used. FIPS compatible is safer statement, but I believe FIPS capability can be also defended. The situation is not changing much between the previous and current builds, so I can move the narration more into FIPS capable direction

I think I misread the intention of your comment/mixed with the other one, and after revisiting my change i think I will go back to previous wording

nastasha-solomon · 2026-08-06T17:40:25Z

 ### TLS [ingest-limitations-tls]

-Only FIPS 140-2 compliant TLS protocols, ciphers, and curve types are allowed to be used as listed below.
+Only FIPS 140-3 compliant TLS protocols, ciphers, and curve types are allowed to be used as listed in the following section.


Continuing this comment, FIPS-compliant means something different as well.

I agree, but regarding the protocols, ciphers and curve types, they are well defined in the FIPS and this section is more like summary than claiming anything about our code/config

nastasha-solomon · 2026-08-06T17:41:42Z

  * `TLS v1.2`: `ECDHE-RSA-AES-128-GCM-SHA256`, `ECDHE-RSA-AES-256-GCM-SHA384`, `ECDHE-ECDSA-AES-128-GCM-SHA256`, `ECDHE-ECDSA-AES-256-GCM-SHA384`
  * `TLS v1.3`: `TLS-AES-128-GCM-SHA256`, `TLS-AES-256-GCM-SHA384`
 * The supported curve types are `P-256`, `P-384` and `P-521`.
+* The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use; see the supported curve types above.


If you can link the docs that readers should refer to, that'd improve the UX here.

Suggested change

* The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use; see the supported curve types above.

* The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use. Refer to the supported curve types above.

nastasha-solomon · 2026-08-06T17:42:15Z

 Be sure to enforce security in your FIPS environments through other means, such as strict file permissions and access controls on the key file itself, for example.

-These TLS related restrictions apply to all components listed--{{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, and {{apm-server}}.
+These TLS related restrictions apply to all components listed in the preceding section.


Same comment here about linking directly to the relevant docs instead of using directional language. (Only if possible ofc)

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

- Fix frontmatter: remove duplicate applies_to key, remove empty navigation_title - Restore FIPS 140-2 intro for cumulative docs; tag FIPS 140-3 content with applies_to stack: ga 9.3+ and note patch versions (9.3.8, 9.4.4, 9.5.0) - Reword intro to "built and configured to use FIPS 140-3 compliant cryptography" (parallel with 140-2 framing) - Restore original default-configurations admonition wording - TLS section: replace directional language with CMVP #5247 link; tag minimum key length bullet for 9.3+; explicit component list in footer - Restore OTel-not-supported bullet scoped to 9.1-9.2; add section-level applies_to and patch version note to EDOT section - Remove version tag from GPG bullet (applies to all FIPS versions) - Restore "even if combined with other ingest tools" clause in integrations intro Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

macdewee · 2026-08-07T17:20:24Z

- using only FIPS approved cryptographic functions
- ensuring that the configuration of the component is FIPS 140-2 compliant.
+
+{applies_to}`stack: ga 9.3+` {{agent}}, {{fleet}}, {{filebeat}}, {{metricbeat}}, and {{apm-server}} binaries are built and configured to use FIPS 140-3 compliant cryptography via Go's native FIPS 140-3 module (`GOFIPS140=v1.0.0`, CMVP Certificate [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247)). This applies to patch versions 9.5.0, 9.4.4, and 9.3.8 and later. Specific components and configurations that fall outside the certified boundary are documented in the [Limitations](#ingest-limitations-all) section.


@shainaraskas @nastasha-solomon Is it correct usage of {applies_to} if we are referring to 9.5.0+, 9.4.4+, and 9.3.8+ ?

github-actions Bot deployed to docs-preview August 6, 2026 08:58 View deployment

Remove Auditbeat/Heartbeat/Packetbeat/Winlogbeat — no FIPS builds

1a5cd51

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot deployed to docs-preview August 6, 2026 09:04 View deployment

Fix vale DirectionalLanguage warnings

80cb88b

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot deployed to docs-preview August 6, 2026 11:08 View deployment

macdewee marked this pull request as ready for review August 6, 2026 11:14

macdewee requested a review from a team as a code owner August 6, 2026 11:14

macdewee requested a review from ebeahan August 6, 2026 11:26

shainaraskas reviewed Aug 6, 2026

View reviewed changes

shainaraskas requested a review from a team August 6, 2026 17:04

shainaraskas reviewed Aug 6, 2026

View reviewed changes

nastasha-solomon reviewed Aug 6, 2026

View reviewed changes

macdewee and others added 6 commits August 7, 2026 16:34

Update deploy-manage/security/fips-ingest.md

07fd6ca

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update deploy-manage/security/fips-ingest.md

b724378

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update deploy-manage/security/fips-ingest.md

f6d0f46

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update deploy-manage/security/fips-ingest.md

c1cd11a

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

Update deploy-manage/security/fips-ingest.md

50ca459

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>

macdewee commented Aug 7, 2026

View reviewed changes

	* The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use; see the supported curve types above.
	* The minimum key length is 2048 bits for RSA keys. EC key size is determined by the curve in use. Refer to the supported curve types above.

Uh oh!

Conversation

macdewee commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Generative AI disclosure

Uh oh!

github-actions Bot commented Aug 6, 2026

Elastic Docs AI PR menu

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Preview links for changed docs

Uh oh!

github-actions Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Elastic Docs Style Checker (Vale)

Uh oh!

shainaraskas left a comment

Choose a reason for hiding this comment

Uh oh!

shainaraskas Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

macdewee commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading

github-actions Bot commented Aug 6, 2026 •

edited

Loading

shainaraskas Aug 6, 2026 •

edited

Loading