FIPS 140-2 sunset: 481 certificates went historical

Update, 25 September. It happened on schedule. The snapshot on the 19th still had 481 active FIPS 140-2 certificates, and the next one, on the 22nd, had none. That one day took about 40% of the active list, which went from 1,190 certificates to 712, all of them 140-3 now.

NIST usually gives a reason on a historical certificate. 466 of the 481 say “moved to historical list due to sunsetting”. 14 are old rows NIST publishes with no vendor or module name, and those carry no reason. The last one is odd. Maxar’s AEDS module (#4649) is marked as moved “due to dependency on certificate #2627”, a Nuvoton TPM that went historical the same day for the ordinary reason. It would have gone anyway. Someone at the CMVP just recorded the dependency first.

Nothing that should have moved stayed behind. NIST doesn’t date these moves, so 22 September is when this tracker saw them, not necessarily the day the listing changed.

FIPS 140-2 stopped accepting new submissions in 2022, and it ended on 2026-09-21, when the CMVP moved every 140-2 certificate that was still active onto the historical list. Historical is not revoked: US and Canadian federal agencies can keep running those modules in systems they already have. They just can't buy them for anything new. The replacement is FIPS 140-3, and NIST's own page on the switch is here. What the switch changes in the standard, and why 140-2 certificates were still being issued this summer, is in FIPS 140-2 vs 140-3: what actually changed.

Nobody outside those two governments is bound by that rule directly. A lot of people are bound by it second-hand, through contracts, procurement checklists and audit frameworks that say "FIPS 140 validated" and mean the active list. If that describes you, the table below is worth checking against your contracts.

The sunset has passed. All 4,420 FIPS 140-2 certificates now sit on the historical list. The last 481 to go are listed below, so you can still check whether something you run was one of them.

What is on the list

210 of these are hardware. A hardware module doesn't get fixed by a firmware push. Either the vendor has already put the same part through 140-3 under a new certificate number, or the answer is a newer product.

Vendors with the most certificates moved:

Certificates moved to historical on 2026-09-21 (481)

Sorted by vendor. Each certificate number links to its own page with the validation history and the caveat field, which is where bound-module surprises live.