808bits

fips 140-3 and 140-2 certificate tracker

Every NIST CMVP FIPS 140 certificate as a fast, linkable page. Status moves are derived by diffing snapshots of the NIST lists, which NIST itself does not date. Data as of 2026-10-21.

5552 certificates
739 active (739 on 140-3, 0 on 140-2)
4788 historical
25 revoked
The FIPS 140-2 sunset has passed. Every FIPS 140-2 certificate is now on the historical list, and all 739 active certificates are FIPS 140-3. What that means.

recent changes rss

  1. 2026-10-21 Luna K7 Cryptographic Module (Thales) left the implementation-under-test list
  2. 2026-10-21 Acme Packet VME (Oracle Communications) left the implementation-under-test list
  3. 2026-10-21 Acme Packet 4600 and Acme Packet 6350 (Oracle Communications) left the implementation-under-test list
  4. 2026-10-21 Acme Packet 1100, Acme Packet 3900, Acme Packet 3950, Acme... (Oracle Communications) left the implementation-under-test list
  5. 2026-10-21 HPE Juniper Networking MX304 Universal Routing Platform with... (HPE Juniper Networking) left the implementation-under-test list
  6. 2026-10-21 FortiProxy-VM 7.4 (Fortinet, Inc.) left the implementation-under-test list
  7. 2026-10-21 FortiProxy 7.4 (Fortinet, Inc.) left the implementation-under-test list
  8. 2026-10-21 DINAMO NG Hardware Security Module (DINAMO Cyber Security Company) left the implementation-under-test list
  9. 2026-10-21 HF SDR Cryptography Module (Codan | DTC) left the implementation-under-test list
  10. 2026-10-21 VMware’s Linux Kernel Cryptographic Module 6.12 (Broadcom Inc.) left the implementation-under-test list

cve cross-reference

4 certificates have high-confidence CVE associations in their module family, matched heuristically against NVD. How matching works and what it does not claim.

  1. 4867 1 CVE Forcepoint Next Generation Firewall Forcepoint
  2. 4937 3 CVEs Purity Encryption Module Pure Storage, Inc.
  3. 4968 9 CVEs SUSE Rancher Kubernetes Cryptographic Library SUSE LLC
  4. 5032 36 CVEs Intel® QuickAssist Technology (QAT) Provider Intel Corporation

reading

What each FIPS 140-3 level actually requires, with the certificate counts behind it, and why a validated module is not a safe one: ROCA, EUCLEAK, and a YubiKey flaw caused by the FIPS self-tests themselves.

browse

  1. f012026-09-21The FIPS 140-2 sunsetwhat moved to historical, and what that means
  2. f02Certificate status changesobserved moves to historical, revocations, new validations
  3. f03Modules in processthe validation queue, phase by phase
  4. f04Implementations under testmodules in lab testing, before submission
  5. f05Vendorsevery vendor and their certificates
  6. f06FIPS 140-3 modules824 certificates, and why level 4 is empty
  7. f07FIPS 140-2 modules4,420 issued, all historical since 2026-09-21
  8. f08Hardware security moduleswhere level 3 and level 4 actually live
  9. f09Drives, SSDs and storageself-encrypting drives, and the level they really hold
  10. f10Software modulesthe largest category, and the one level 3 never reaches
  11. f11The tracker as an MCP serverquery all of this from Claude or any MCP client
  12. f12About this trackersources, cadence, methodology, what we leave out