How to enable FIPS#

To use FIPS, one can either launch existing Ubuntu premium support images which already have FIPS kernel and security pre-enabled on first boot at AWS Ubuntu Pro FIPS images, Azure Pro FIPS images and GCP Pro FIPS Images.

Alternatively, you can enable FIPS using the Ubuntu Pro Client, which will install a FIPS-certified kernel and core security-related packages such as openssh-server/client and libssl.


Disabling FIPS is not recommended: only enable it on machines intended expressly for this purpose.


Enabling FIPS should be performed during a system maintenance window because this operation makes changes to underlying SSL-related libraries and requires a reboot into the FIPS-certified kernel.


Once you enable FIPS, enabling some Pro services will not be possible. For a better view of which services are incompatible with FIPS, please look at the services compatibility matrix

To enable FIPS, run:

$ sudo pro enable fips

You should see output like the following, indicating that the FIPS packages has been installed:

Installing FIPS packages
FIPS enabled
A reboot is required to complete install.

Disable the service#

If you wish to disable FIPS, you can use the following command:

sudo pro disable fips

Note that this command will only remove the APT sources, but not uninstall the packages installed with the service. Your system will still have the FIPS packages installed after FIPS is disabled.

To purge the service, removing the APT packages installed with it, potentially removing also the FIPS kernel, see how to disable and purge services.