808bits

fips 140-3 and 140-2 certificate tracker

Every NIST CMVP FIPS 140 certificate as a fast, linkable page. Status moves are derived by diffing snapshots of the NIST lists, which NIST itself does not date. Data as of 2026-10-09.

5538 certificates
726 active (726 on 140-3, 0 on 140-2)
4787 historical
25 revoked
The FIPS 140-2 sunset has passed. Every FIPS 140-2 certificate is now on the historical list, and all 726 active certificates are FIPS 140-3. What that means.

recent changes rss

  1. 2026-10-09 SBP (Microsoft Corporation) left the implementation-under-test list
  2. 2026-10-09 DPU FunOS Cryptolib (Microsoft Corporation) left the implementation-under-test list
  3. 2026-10-09 Trizinc Hardware Appliances (Infoblox) left the implementation-under-test list
  4. 2026-10-09 QiSpace™ SDK Cryptographic Module (Quantropi, Inc.) appeared on the implementation-under-test list
  5. 2026-10-09 Nexthop OAM Security Module v1 (Nexthop AI) appeared on the implementation-under-test list
  6. 2026-10-09 Isidore Mini Core (Forward Edge-AI, Inc.) appeared on the implementation-under-test list
  7. 2026-10-09 Commcrete Crypto Core (Commcrete Ltd.) appeared on the implementation-under-test list
  8. 2026-10-09 Infosec HSM Cryptographic Module (Beijing Infosec Technologies Co., LTD.) appeared on the implementation-under-test list
  9. 2026-10-09 TW-860-F TSM Spirit (TrellisWare Technologies, Inc.) left the modules-in-process list
  10. 2026-10-09 IDPrime PIV 4.0 FIDO on IDCore3230 Platform (Thales) left the modules-in-process list

cve cross-reference

4 certificates have high-confidence CVE associations in their module family, matched heuristically against NVD. How matching works and what it does not claim.

  1. 4867 1 CVE Forcepoint Next Generation Firewall Forcepoint
  2. 4937 3 CVEs Purity Encryption Module Pure Storage, Inc.
  3. 4968 9 CVEs SUSE Rancher Kubernetes Cryptographic Library SUSE LLC
  4. 5032 36 CVEs Intel® QuickAssist Technology (QAT) Provider Intel Corporation

reading

What each FIPS 140-3 level actually requires, with the certificate counts behind it, and why a validated module is not a safe one: ROCA, EUCLEAK, and a YubiKey flaw caused by the FIPS self-tests themselves.

browse

  1. f012026-09-21The FIPS 140-2 sunsetwhat moved to historical, and what that means
  2. f02Certificate status changesobserved moves to historical, revocations, new validations
  3. f03Modules in processthe validation queue, phase by phase
  4. f04Implementations under testmodules in lab testing, before submission
  5. f05Vendorsevery vendor and their certificates
  6. f06FIPS 140-3 modules810 certificates, and why level 4 is empty
  7. f07FIPS 140-2 modules4,420 issued, all historical since 2026-09-21
  8. f08Hardware security moduleswhere level 3 and level 4 actually live
  9. f09Drives, SSDs and storageself-encrypting drives, and the level they really hold
  10. f10Software modulesthe largest category, and the one level 3 never reaches
  11. f11The tracker as an MCP serverquery all of this from Claude or any MCP client
  12. f12About this trackersources, cadence, methodology, what we leave out