FIPS 140-2 validated modules

FIPS 140-2 was the standard from 2001 until 140-3 replaced it for new submissions. 4,420 certificates were issued under it, which is most of the programme’s history, and 485 are still active as of the latest snapshot.

All 485 move to the historical list on 21 September 2026. Historical does not mean withdrawn or broken. It means a federal agency may keep the module in a system it already runs but may not buy it new, and it means the vendor cannot point at that certificate for a new procurement. The sunset page has the full affected list and what to check before the date.

Only the still-active certificates are listed below, because those are the ones where the date matters. The other 3,935 are already historical and remain on their own pages and in the full index, which has a search box.

The vendors with the most exposure are the ones with the most certificates overall: Cisco, Microsoft and Juniper. If you are trying to work out your own exposure, the vendor pages split active from historical, so a vendor with active 140-2 certificates and no 140-3 equivalent is the case worth a conversation.

For what the certificate attests either way, FIPS 140-3 is not a security guarantee is worth reading before the sunset conversation, and the levels article covers what a level actually buys.

Vendors

Active certificates (485)

3935 more are historical or revoked. Those stay on their own certificate pages and in the full index, which has a search box.