> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/admin-guide/32/how-to-guides/deploy-in-fips-mode.md).

# Deploy in FIPS mode

The Console, Defender and twistcli Compute components can run using FIPS140-2 Level 1 validated cryptographic modules. The Compute GoLang components are statically compiled with the [BoringCrypto module](https://boringssl.googlesource.com/boringssl/+/master/crypto/fipsmodule/FIPS.md), using the built-in mechanism introduced in Go1.19 [GOEXPERIMENT](https://pkg.go.dev/internal/goexperiment).

The cipher suites used are:

* TLS\_ECDHE\_RSA\_WITH\_AES\_128\_GCM\_SHA256
* TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384
* TLS\_ECDHE\_ECDSA\_WITH\_AES\_128\_GCM\_SHA256
* TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384

The following procedures are for [self-hosted](/admin-guide/32/welcome/pcee-vs-pcce.md) deployments only.

1. Download the latest release tar bundle from the Palo Alto Networks [Customer Support Portal](https://support.paloaltonetworks.com/).

   Note that v22.12 or later is certified for FIPS.
2. Untar the release

   ```
   $ tar -xzf prisma_cloud_compute_<VERSION>.tar.gz
   ```
3. Set the FIPS mode for deployment.
   * For Onebox deployments, modify twistlock.cfg and set the FIPS\_ENABLED flag to "true."

     ```
     ##### FIPS configuration #####
      # Forces Console and Defender to use FIPS-compliant cryptography, https://csrc.nist.gov/projects/cryptographic-module-validation-program
      FIPS_ENABLED=true
     ```
   * For Kubernetes deployments, download the Defender YAML file from Console and and set the FIPS\_ENABLED flag to "true."
4. Deploy the Console either via the [Onebox](/admin-guide/32/install/deploy-console/console-on-onebox.md) or [Kubernetes](/admin-guide/32/install/deploy-console/console-on-kubernetes.md) deployment methods.
5. To confirm the Console is running in FIPS mode, login to the Console and go to Manage > Logs > Console and search for "FIPS." *FIPSEnabled: true* is confirmation that the Console has started in FIPS mode.

   ```
   manager.go:73 Starting Console manager: ConsoleCN: STIG.lomsgaupfzzurnlkzzmxivmymh.cx.internal.cloudapp.net, ConsoleSAN: [IP:127.0.0.1 IP:10.0.1.4 IP:172.17.0.1], IsProd: true, DataRecoveryEnabled: true, DefenderPort: 8084, MgmtPortHTTPS: 8083, Version: 22.12.415, FIPSEnabled: true
   ```
6. To confirm that the Defender is running in FIPS mode, login to the Console and go to Manage > Defenders > Defenders: Deployed in the Actions column of the Defender(s) click Logs and search for "FIPS."

   ```
   defender.go:778 FIPS mode enabled true
   ```
7. When using the *twistcli* command line tool use the **FIPS\_ENABLED=true** variable to enforce FIPS validated TLS communication to the Console, for example:

   ```
   $ FIPS_ENABLED=true ./twistcli images scan --address https://127.0.0.1:8083 0c413668ee0d
   ```
8. The Jenkins plug-in communication to the Console can enforce FIPS compliant TLS traffic, enable **FIPS mode** in the Prisma Cloud Jenkins plug-in’s configuration.

   <figure><img src="/files/MXDqpfWMqkCBh1FqHKd0" alt="jenkins plug in fips"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/admin-guide/32/how-to-guides/deploy-in-fips-mode.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.