Enable FIPS 140-2 Mode on Rocky Linux 9 with dracut-fips

Useful answer first

If you need FIPS 140-2 validated cryptography on Rocky Linux 9, the supported path is dracut-fips plus the kernel parameter fips=1. Install dracut-fips, rebuild the initramfs, add fips=1 to GRUB_CMDLINE_LINUX, regenerate grub.cfg, and reboot. After boot, /proc/sys/crypto/fips_enabled reads 1 and the kernel crypto API rejects non-approved algorithms.

FIPS 140-2 is a US government validation standard for cryptographic modules. On Rocky Linux 9 the kernel can enforce a FIPS mode, but the initramfs must contain the FIPS policy files. That is the role of the dracut-fips package.

How FIPS mode is enforced on boot

The kernel checks the fips=1 command line early. If present, the crypto API locks to a whitelist of approved algorithms such as AES and SHA-256 and refuses to load modules that are not FIPS validated. dracut-fips installs the policy and the necessary early-boot components into the initramfs so the check succeeds before the real root filesystem is mounted.

Without a rebuilt initramfs, the kernel will see fips=1 but lack the policy files and will either fail to enter FIPS mode or drop to an emergency shell. That is why the initramfs step is not optional.

Worked configuration for Rocky Linux 9

Run all steps as root or with sudo. Changes affect boot configuration.

1. Install the FIPS support package.

sudo dnf install dracut-fips

Risk: installing the package alone does not enable FIPS. The system continues in non-FIPS mode until reboot with the correct parameters.

1. Regenerate the initramfs for the running kernel.

sudo dracut -f

Expected check: the command completes without errors and updates /boot/initramfs-$(uname -r).img. Skipping this step is a common cause of a non-FIPS boot despite fips=1 being set.

1. Enable the kernel parameter in GRUB.

sudo nano /etc/default/grub

Edit the line GRUB_CMDLINE_LINUX to include fips=1. Example form:

GRUB_CMDLINE_LINUX="... existing options ... fips=1"

Do not duplicate the parameter. Place it inside the quoted string, not in GRUB_CMDLINE_LINUX_DEFAULT unless you want it on all entries.

1. Rebuild the GRUB configuration.

sudo grub2-mkconfig -o /boot/grub2/grub.cfg

On UEFI systems the output path may be /boot/efi/EFI/rocky/grub.cfg. Verify the path for your installation.

1. Reboot and verify.

sudo reboot

After login, check the kernel state:

cat /proc/sys/crypto/fips_enabled

A value of 1 indicates FIPS mode is active. The dracut-fips package provides fipsmode-check which reports the mode status.

You can also confirm the OpenSSL provider selection:

openssl list -providers

In FIPS mode only the FIPS provider should be active. Presence of legacy providers indicates the system is not fully restricted.

Limits and operational constraints

FIPS mode is system-wide. Once enabled, the kernel crypto API will reject non-approved algorithms. Applications that depend on non-FIPS ciphers, custom OpenSSL builds, or third-party libraries compiled without FIPS awareness will fail to load or produce errors.

There is a small performance overhead from additional self-tests at boot and stricter algorithm selection. Custom kernels or out-of-tree kernel modules must be rebuilt after enabling FIPS, otherwise they may be refused by the crypto API.

Reverting requires removing fips=1 from GRUB_CMDLINE_LINUX, rebuilding grub.cfg, and rebooting. If you have installed FIPS-only packages, you may need to reinstall affected software after disabling FIPS.

Common mistakes

Forgetting to rebuild the initramfs after installing dracut-fips. The kernel parameter will be present but the policy files will be missing from early boot.

Mixing non-FIPS OpenSSL libraries with system libraries. Installing a custom OpenSSL from source or a third-party repo can reintroduce non-validated algorithms and break compliance.

Changing SELinux contexts after enabling FIPS without relabeling. Some early-boot labeling steps are skipped when the FIPS policy is loaded, so a full relabel may be required after significant filesystem changes.

Assuming FIPS mode is on because the grub line was edited. Always verify with /proc/sys/crypto/fips_enabled after reboot.