FIPS Compliance

Federal Information Processing Standard (FIPS) 140-3 defines the security requirements for cryptographic modules used by systems that handle sensitive information. You can deploy the Solace Software Event Broker so that all network communication to and from the event broker is encrypted using a FIPS-certified cryptographic module, which lets you run the event broker in environments that require FIPS compliance.

In a FIPS-compliant deployment, the software event broker runs a FIPS container image that includes a FIPS 140-3 certified cryptographic module provided by Red Hat. When the host is running in FIPS mode, it signals the container instance to operate in FIPS mode and use the certified module.

The FIPS-compliant container image is a Controlled Availability (CA) feature. Please contact Solace to obtain the FIPS container image and product keys.

Effect of FIPS Mode on the Event Broker

When the host is running in FIPS mode, it restricts the cryptographic module in the container to FIPS-certified algorithms. This restriction is the main behavioral difference between a FIPS-compliant deployment and a standard deployment, in which the event broker can use any supported cipher suite.

The default configuration includes some cipher suites that are not FIPS-compliant, and you cannot change the configuration until the event broker is running. Before you put the event broker into service, configure it to use only FIPS-compliant cipher suites.

If a client connects using a cipher suite that is not FIPS-compliant while the host is running in FIPS mode, the event broker can terminate unexpectedly. Configure the event broker to use only FIPS-compliant cipher suites before you put it into service. For more information, see Configuring Cipher Suites for Inbound Connections.

Supported Deployments

FIPS compliance is supported only for self-managed software event brokers that you deploy and operate in your own environment. It is not available for event broker services that Solace Cloud manages.

Setting Up a FIPS-Compliant Event Broker

To set up a FIPS-compliant software event broker, perform these steps:

  1. Ensure the host that runs the container is in FIPS mode. The steps to enable and verify FIPS mode depend on your host operating system, so consult your operating system documentation. For example, on Red Hat Enterprise Linux, the host is in FIPS mode when the following command returns 1:

    cat /proc/sys/crypto/fips_enabled

    Depending on the container runtime, you may also need to mount the host's FIPS indicator file (for example, /etc/system-fips) into the container.

  2. Deploy the FIPS container image. The FIPS container image is a separate product from the regular software event broker.

  3. Install the FIPS product key on the primary, backup, and monitoring nodes by passing the productkey configuration key as an environment variable when you create the container. For example:

    --env 'productkey=<FIPS product key>'

    For more information, see Product Keys .

  4. Configure the event broker to use only FIPS-compliant cipher suites. For the cipher suites that are FIPS-compliant, see Supported Cipher Suites; for configuration steps, see Configuring Cipher Suites for Inbound Connections.
  5. Enable TLS on all inbound and outbound connections, and disable or block plain text ports. For more information, see TLS/SSL Service Connections.

Verifying FIPS Compliance

After you configure the software event broker, use the following Solace Event Broker CLI commands to confirm that the event broker is configured for FIPS-compliant operation:

  1. Confirm that a server certificate is configured:

    solace> show ssl server-certificate

  2. Confirm that every administratively enabled service uses TLS. In the output, the S (SSL) column must be Y for each service that shows U in the A (Admin State) column:

    solace> show service

  3. Confirm that Config-Sync uses TLS:

    solace> show config-sync

  4. Confirm that redundancy, including the mate-link connection, uses TLS:

    solace> show redundancy detail

  5. Confirm that the plain text messaging services are disabled in each Message VPN:

    solace> show message-vpn <vpn-name> service

    By default, the following messaging services have plain text ports enabled:

    • SMF (55555)
    • SMF compressed (55003)
    • Web Transport (8008)
    • MQTT (1883)
    • MQTT over WebSockets (8000)
    • AMQP (5672)
    • REST (9000)

    You cannot disable the plain text ports for SMF, SMF compressed, and Web Transport directly; disable these services in each Message VPN, or block the ports externally. For a complete list of default ports, see Default Port Numbers.

These commands confirm the event broker configuration. Verifying that the underlying event broker processes are linked against the FIPS-certified cryptographic module is not covered here; contact Solace if you require that level of attestation for an audit.