# FIPS 140-2 Config, On-Prem

**URL:** <https://discuss.elastic.co/t/fips-140-2-config-on-prem/329686>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 10, 2023, 7:42pm UTC](https://discuss.elastic.co/t/fips-140-2-config-on-prem/329686 "2023-04-10T19:42:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![pschadha1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pschadha1/32/119593_2.png) [@pschadha1](https://discuss.elastic.co/u/pschadha1)\
**Post date:** [April 10, 2023, 7:42pm UTC](https://discuss.elastic.co/t/fips-140-2-config-on-prem/329686/1 "2023-04-10T19:42:10Z")

</div>

Hello,

We have a requirement to run ES in FIPS mode. I understand that _ **xpack.security.fips\_mode.enabled** _ is what allows ES to run in a JVM that is configured for FIPS. I also understand that it requires a Platinum license. A couple things I don't understand:

1. Isn't Platinum licensing only for the cloud offering? We are running it on our own VMs for compliance reasons (FedRAMP High). Is there any licensing appropriate for this when running on prem?

2. Can the FIPS approved mode run when ES is running as a service on a Windows box?

Thanks.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [April 10, 2023, 9:05pm UTC](https://discuss.elastic.co/t/fips-140-2-config-on-prem/329686/2 "2023-04-10T21:05:04Z")

</div>

> [@pschadha1](#):
>
> Isn't Platinum licensing only for the cloud offering?

No, you can have a license to run on-premises as well, If I'm not wrong it has a minimum of 5 nodes, but you need to contact the Elastic sales team about this information.

> [@pschadha1](#):
>
> Can the FIPS approved mode run when ES is running as a service on a Windows box?

I think there is no issue as Elasticsearch runs on a JVM, but you need to carefully read this part of the [documentation](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/fips-140-compliance.html).

The bundled JVM is not configured for FIPS 140-2, you will need to configure an external JDK and use this JVM to run Elasticsearch.

Also, you will probably need to run 7.17.

> Elasticsearch 8.7.0 requires Java 17 or later. There is not yet a FIPS-certified security module for Java 17 that you can use when running Elasticsearch 8.7.0 in FIPS 140-2 mode. If you run in FIPS 140-2 mode, you will either need to request an exception from your security organization to upgrade to Elasticsearch 8.7.0, or remain on Elasticsearch 7.x until Java 17 is certified.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2023, 9:05pm UTC](https://discuss.elastic.co/t/fips-140-2-config-on-prem/329686/3 "2023-05-08T21:05:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.