---
title: "FIPS mode"
description: "Run Calico Open Source in FIPS 140-2 compliant mode using NIST-validated cryptographic modules and FIPS-approved algorithms across all data plane components."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Operations"
canonical_url: "https://docs.tigera.io/calico/latest/operations/fips"
---

# FIPS mode

> **INFO:** FIPS mode is deprecated and will be removed in a future release.

## Big picture

Run Calico in [FIPS 140-2](https://csrc.nist.gov/publications/detail/fips/140/2/final) compliant mode.

## Value

When running in FIPS compliant mode, Calico uses FIPS-approved cryptographic algorithms and NIST-validated cryptographic modules.

## Concepts

The Federal Information Processing Standards (FIPS) are publicly announced standards developed by the National Institute of Standards and Technology for use in computer systems by government agencies and government contractors. Calico FIPS mode is enabled during installation by:

- Switching the cryptographic modules for the golang-based applications to use the FIPS-140-2 validated [Tigera Cryptographic Module](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4095)
- Configuring TLS servers and other cryptographic functions to use FIPS 140-2 approved cryptographic algorithms

## Before you begin

**Required**

- A Kubernetes distribution and cluster that run in FIPS mode

- The hosts must run Linux x86\_64 distributions

- Calico contains programs that run directly on the host that use dynamic linking of c libraries. For this reason, it is a requirement for host systems to contain the following libraries:

  - ld-linux-x86-64.so.2
  - libpthread.so.0
  - libc.so.6

**Unsupported**

- The following features are disabled and are not allowed to be used:

  - Application Layer API
  - BGP password
  - WireGuard

- Switching FIPS mode off and then on again is not supported because this can break hashes and other cryptographic settings.

## How to

To install Calico in FIPS mode follow these steps.

Follow [the installation steps](https://docs.tigera.io/calico/latest/getting-started.md) for your platform.

- In the step for installing custom resources, edit `custom-resources.yaml` and enable FIPS mode in the installation spec.

```yaml
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  fipsMode: Enabled
```

- For more information on configuration options available in this manifest, see [the installation reference](https://docs.tigera.io/calico/latest/reference/installation/api.md).

After you apply the YAML, FIPS mode is fully operational.