FIPS mode

In FIPS mode, Langfuse runs its cryptography on FIPS 140-3 validated cryptographic modules operated in approved mode, and refuses to start when it cannot. FIPS mode is part of Hardening for Government.

The Cryptographic Module Validation Program (CMVP) validates cryptographic modules, not products. Langfuse holds no FIPS 140-3 certificate of its own. In FIPS mode, the Langfuse containers use the validated modules listed below in approved mode, and check this at startup. Algorithms that are not approved, such as MD5, fail.

FIPS mode is available from Langfuse v4.57.0 or later.

Cryptographic modules

Node.js and the Prisma engines link the image's system OpenSSL library, so their cryptography runs in Red Hat's FIPS provider. The migration CLI is built with GOFIPS140=v1.0.0, which turns on the Go module's FIPS 140-3 mode.

Tested environments: certificate #4857 lists Red Hat Enterprise Linux 9 on x86_64 (Intel Xeon), IBM POWER10, and IBM z16. Running the linux/amd64 images on RHEL 9 hosts in FIPS mode matches a tested environment. Confirm other host operating systems and linux/arm64 with your assessor.

Module build: the FIPS provider comes from the openssl-fips-provider-so package in the UBI 9 repositories. Red Hat rebuilds this package for security fixes, so the build in the image can be newer than the build listed on the certificate while its revalidation is in process. Check the package version that your image scanner reports against the certificate and the CMVP Modules In Process list.

Requirements

• Enterprise license: an Enterprise license key (LANGFUSE_EE_LICENSE_KEY) on both containers. See License Key.
• Host FIPS mode: the hosts that run the containers must boot in FIPS mode (cat /proc/sys/crypto/fips_enabled returns 1). The FIPS provider follows the host kernel's FIPS mode, so a container cannot turn it on by itself.
• Infrastructure: you are responsible for running Postgres, ClickHouse, Redis, blob storage, and the load balancer or ingress that terminates TLS for Langfuse with validated modules. In particular:
  • Use scram-sha-256 password authentication for Postgres. md5 authentication is not available on a Postgres server in FIPS mode.
  • Do not set LANGFUSE_S3_DELETE_OBJECTS_CHECKSUM_ALGORITHM=MD5. MinIO versions before RELEASE.2025-02-03 require it and are therefore not supported.
  • Do not use the native OCI Object Storage integration (LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE=true); the OCI SDK hashes every upload part with MD5. Use OCI's S3-compatible API instead.

Enable FIPS mode

Set the following on both the web and the worker container:

LANGFUSE_REQUIRE_FIPS=true
LANGFUSE_EE_LICENSE_KEY=<your-license-key>

When LANGFUSE_REQUIRE_FIPS=true is set, startup fails closed:

1. The image entrypoint sets OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf, which applies Red Hat's FIPS crypto policy to OpenSSL. An OPENSSL_CONF you set yourself takes precedence.
2. The entrypoint exits before running database migrations if Node.js reports that the FIPS provider is not active.
3. The web and worker processes check again before they connect to any database. They also require an Enterprise license and reject storage options that need MD5. These checks also run when your deployment overrides the image entrypoint. In that case, set OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf yourself.

If a check fails, the container logs the reason and exits:

A running container with LANGFUSE_REQUIRE_FIPS=true has passed these checks. To check the module by hand, for example during an assessment, run Node.js in the container with the same OpenSSL configuration:

docker exec <langfuse-web-container> sh -c \
  'OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf node -p "require(\"node:crypto\").getFips()"'
# 1

docker exec <langfuse-web-container> sh -c \
  'OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf node -e "require(\"node:crypto\").createHash(\"md5\")"'
# Error: ... unsupported

Passwords

In FIPS mode, Langfuse hashes and verifies email/password credentials only with PBKDF2-HMAC-SHA256 (600,000 iterations), and never runs bcrypt. Passwords set before you turned on FIPS mode are stored as bcrypt hashes, which FIPS mode does not verify. Those users cannot sign in until they set a new password:

• Sign-in fails with: This instance runs in FIPS mode and your password must be reset.
• Users set a new password with the forgot password? link on the sign-in page. Password reset sends a code by email, so configure transactional emails before you turn on FIPS mode, or move users to SSO.
• Users who sign in with SSO are not affected.

If you turn FIPS mode off later, PBKDF2 passwords keep working: instances without FIPS mode verify both formats and write bcrypt for new passwords.

Known limitations

• Legacy API keys: API keys created by early Langfuse versions, before keys were hashed with SHA-256, are checked once with bcrypt on first use and then re-hashed with SHA-256. Rotate such keys to avoid bcrypt entirely.

If you experience any issues when self-hosting Langfuse, please:

1. Check out Troubleshooting & FAQ page.
2. Use Ask AI to get instant answers to your questions.
3. Ask the maintainers on GitHub Discussions.
4. Create a bug report or feature request on GitHub.