STIGQter: STIG Summary: F5 NGINX Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 25 Nov 2025:

NGINX must be configured to use a FIPS-validated cryptographic module for confidentiality and integrity.

DISA Rule

SV-278407r1172754_rule

Vulnerability Number

V-278407

Group Title

SRG-APP-000630

Rule Version

NGNX-APP-002660

Severity

CAT II

CCI(s)

• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

FIPS must be enabled on the operating system.

Follow the OS guidelines for installing FIPS mode.

After installation, confirm that FIPS is enabled:

# sudo sysctl –a | grep fips
crypto.fips_enabled = 1

Install the FIPS-validated version of OpenSSL to the operating system.

Check Contents

Verify NGINX is using OpenSSL with FIPS enabled.

For version 1.x:

# nginx -V

nginx version: nginx/1.15.2 (nginx-plus-r16)
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017"

If the response does not include "fips" in the OpenSSL version, this is a finding.

For version 3.x:

# openssl list -providers

Providers:
base
name: OpenSSL Base Provider
version: 3.2.2
status: active
default
name: OpenSSL Default Provider
version: 3.2.2
status: active
fips
name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
version: 3.2.2-622cc79c634cbbef
status: active

If the response does not list a FIPS provider with a status of "active", this is a finding.

Vulnerability Number

V-278407

Documentable

False

Rule Version

NGNX-APP-002660

Severity Override Guidance

Verify NGINX is using OpenSSL with FIPS enabled.

For version 1.x:

# nginx -V

nginx version: nginx/1.15.2 (nginx-plus-r16)
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC)
built with OpenSSL 1.0.2k-fips 26 Jan 2017"

If the response does not include "fips" in the OpenSSL version, this is a finding.

For version 3.x:

# openssl list -providers

Providers:
base
name: OpenSSL Base Provider
version: 3.2.2
status: active
default
name: OpenSSL Default Provider
version: 3.2.2
status: active
fips
name: Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider
version: 3.2.2-622cc79c634cbbef
status: active

If the response does not list a FIPS provider with a status of "active", this is a finding.

Check Content Reference

M

Target Key

5720