FIPS 140-2/140-3 Compliance
Customers in regulated industries, government, healthcare, and financial services, often ask whether IronPDF is FIPS compliant or can run where FIPS mode is enforced (for example Windows Group Policy "System cryptography: Use FIPS compliant algorithms," FedRAMP, HIPAA, PCI-DSS, or DoD IL environments). IronPDF does not implement its own cryptography; it delegates every cryptographic operation to the host platform's validated providers.
IronPDF is FIPS-compatible but not FIPS-certified. This applies to all versions.
FIPS-Compatible vs FIPS-Certified
The two terms get used interchangeably but mean very different things.
- FIPS-Certified: a specific cryptographic module has been submitted to NIST's Cryptographic Module Validation Program (CMVP), tested by an accredited laboratory, and issued a formal validation certificate. It is an expensive, time-consuming process, and it applies to cryptographic modules, not entire applications.
- FIPS-Compatible (sometimes called FIPS-compliant): software can operate correctly in an environment where FIPS mode is enforced, typically by delegating all cryptographic operations to an already-certified module, such as the Windows OS kernel-mode cryptographic provider
bcryptprimitives.dllor OpenSSL's FIPS provider.
What IronPDF Delegates, and to What
IronPDF does not implement its own cryptographic algorithms. It relies on the underlying platform's providers instead:
- On .NET, cryptographic calls go through
System.Security.Cryptography, which delegates to OS-level FIPS-validated modules on Windows. On Java, they go through the JVM's security providers. - With Windows FIPS mode enabled via Group Policy, IronPDF continues to function normally because it does not call any non-FIPS algorithms directly.
- PDF encryption and digital signatures delegate to .NET's built-in cryptographic APIs, which respect the OS-level FIPS policy.
IronPDF's internal Chromium rendering engine uses BoringSSL for TLS connections, for example when rendering URLs or loading remote assets. BoringSSL is not FIPS-certified by default. Google maintains a separate FIPS-validated build of BoringCrypto, but IronPDF's bundled Chromium uses the standard BoringSSL build, not that FIPS-validated variant.
Which Scenarios Work Under FIPS Mode
- HTML string to PDF rendering: works, with no external TLS required.
- URL to PDF rendering (HTTPS): conditional. Chromium's BoringSSL handles TLS and is not FIPS-validated, but it uses
AES-GCM/SHA-256, which are FIPS-approved algorithms. - PDF encryption (AES-128/256): works, delegating to .NET
System.Security.Cryptography. - Digital signatures (X.509): works, delegating to .NET
System.Security.Cryptography. - PDF reading/writing (no crypto): works, since no cryptographic operations are involved.
Strict Certification of Every Binary
When certification of every binary in the stack is a hard requirement, which is rare outside DoD IL4+ environments, note that the embedded Chromium's BoringSSL module is not independently FIPS-certified. To minimize the TLS dependency in that case, disable the GPU and render from HTML strings rather than live URLs where possible:
IronPdf.Installation.ChromeGpuMode = IronPdf.Engines.Chrome.ChromeGpuModes.Disabled;IronPdf.Installation.ChromeGpuMode = IronPdf.Engines.Chrome.ChromeGpuModes.Disabled
Curtis Chau holds a Bachelor’s degree in Computer Science (Carleton University) and specializes in front-end development with expertise in Node.js, TypeScript, JavaScript, and React. Passionate about crafting intuitive and aesthetically pleasing user interfaces, Curtis enjoys working with modern frameworks and creating well-structured, visually appealing manuals.
