What Rob (and Alexander) are saying is: your auditor will do an audit and tell you if you are FIPS compliant. While using software in FIPS-compliant mode might reduce the amount of work you'll need to do to be compliant, it's not some sort of labeling procedure where you need show some specs that tell the auditor the things you use are FIPS-compliant. It's the auditor that gives you compliance, not the software.

John


On 19 Apr 2021, at 17:32, Steve Reed via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

Hi Rob,

So, are you saying that CENTOS is not FIPS compliant?  Because there is a long list of web sites that state that CENTOS and RHEL are FIPS 140-2 compliant.

https://www.google.com/search?q=is+centos+7+fips+compliant&rlz=1C1DKCZ_enUS768US768&oq=Is+Centos+7+FIPS+com&aqs=chrome.0.0j69i57j0i390l2.6417j0j15&sourceid=chrome&ie=UTF-8&safe=active
_______________________________________________
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure