--- title: FIPS mode for self-hosted Langfuse description: Run self-hosted Langfuse Enterprise on FIPS 140-3 validated cryptographic modules in approved mode. label: "Version: v4" sidebarTitle: "FIPS mode" --- # FIPS mode **Where is this feature available?** | Plan | Availability | | --- | --- | | Hobby | Not Available | | Core | Not Available | | Pro | Not Available | | Enterprise | Not Available | | Self Hosted | Enterprise Edition | In FIPS mode, Langfuse runs its cryptography on FIPS 140-3 validated cryptographic modules operated in approved mode, and refuses to start when it cannot. FIPS mode is part of [Hardening for Government](/self-hosting/configuration/hardening#hardening-for-government). The Cryptographic Module Validation Program (CMVP) validates cryptographic modules, not products. Langfuse holds no FIPS 140-3 certificate of its own. In FIPS mode, the Langfuse containers use the validated modules listed below in approved mode, and check this at startup. Algorithms that are not approved, such as MD5, fail. FIPS mode is available from Langfuse v4.57.0 or later. ## Cryptographic modules [#fips-modules] | Component | Used for | Validated module | CMVP certificate | | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Node.js (web and worker) | TLS to ClickHouse, Redis, blob storage, SSO and LLM providers; hashing; [application-level encryption](/self-hosting/configuration/encryption); session tokens | Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider | [#4857](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4857) | | Prisma engines (web and worker) | TLS to Postgres | Red Hat Enterprise Linux 9 - OpenSSL FIPS Provider | [#4857](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4857) | | ClickHouse migration CLI (`migrate`, web container) | TLS to ClickHouse during migrations | Go Cryptographic Module v1.0.0 | [#5247](https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247) | Node.js and the Prisma engines link the image's system OpenSSL library, so their cryptography runs in Red Hat's FIPS provider. The migration CLI is built with `GOFIPS140=v1.0.0`, which turns on the Go module's FIPS 140-3 mode. **Tested environments:** certificate #4857 lists Red Hat Enterprise Linux 9 on x86_64 (Intel Xeon), IBM POWER10, and IBM z16. Running the `linux/amd64` images on RHEL 9 hosts in FIPS mode matches a tested environment. Confirm other host operating systems and `linux/arm64` with your assessor. **Module build:** the FIPS provider comes from the `openssl-fips-provider-so` package in the UBI 9 repositories. Red Hat rebuilds this package for security fixes, so the build in the image can be newer than the build listed on the certificate while its revalidation is in process. Check the package version that your image scanner reports against the certificate and the CMVP [Modules In Process list](https://csrc.nist.gov/projects/cryptographic-module-validation-program/modules-in-process/modules-in-process-list). ## Requirements [#fips-requirements] - **Enterprise license:** an Enterprise license key (`LANGFUSE_EE_LICENSE_KEY`) on both containers. See [License Key](/self-hosting/license-key). - **Host FIPS mode:** the hosts that run the containers must boot in FIPS mode (`cat /proc/sys/crypto/fips_enabled` returns `1`). The FIPS provider follows the host kernel's FIPS mode, so a container cannot turn it on by itself. - **Infrastructure:** you are responsible for running Postgres, ClickHouse, Redis, blob storage, and the load balancer or ingress that terminates TLS for Langfuse with validated modules. In particular: - Use `scram-sha-256` password authentication for Postgres. `md5` authentication is not available on a Postgres server in FIPS mode. - Do not set `LANGFUSE_S3_DELETE_OBJECTS_CHECKSUM_ALGORITHM=MD5`. MinIO versions before `RELEASE.2025-02-03` require it and are therefore not supported. - Do not use the native OCI Object Storage integration (`LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE=true`); the OCI SDK hashes every upload part with MD5. Use OCI's S3-compatible API instead. ## Enable FIPS mode [#enable-fips-mode] Set the following on both the web and the worker container: ```bash LANGFUSE_REQUIRE_FIPS=true LANGFUSE_EE_LICENSE_KEY= ``` When `LANGFUSE_REQUIRE_FIPS=true` is set, startup fails closed: 1. The image entrypoint sets `OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf`, which applies Red Hat's FIPS crypto policy to OpenSSL. An `OPENSSL_CONF` you set yourself takes precedence. 2. The entrypoint exits before running database migrations if Node.js reports that the FIPS provider is not active. 3. The web and worker processes check again before they connect to any database. They also require an Enterprise license and reject storage options that need MD5. These checks also run when your deployment overrides the image entrypoint. In that case, set `OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf` yourself. If a check fails, the container logs the reason and exits: | Log message contains | Cause | Fix | | -------------------------------------------- | ---------------------------------------------- | ----------------------------------------- | | `requires a Langfuse enterprise license` | No Enterprise license key is configured. | Set `LANGFUSE_EE_LICENSE_KEY`. | | `Node's OpenSSL FIPS provider is not active` | The host does not run in FIPS mode. | Run the containers on hosts in FIPS mode. | | `cannot be combined with` | A storage option that needs MD5 is configured. | Change the option named in the message. | A running container with `LANGFUSE_REQUIRE_FIPS=true` has passed these checks. To check the module by hand, for example during an assessment, run Node.js in the container with the same OpenSSL configuration: ```bash docker exec sh -c \ 'OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf node -p "require(\"node:crypto\").getFips()"' # 1 docker exec sh -c \ 'OPENSSL_CONF=/etc/pki/tls/openssl-fips.cnf node -e "require(\"node:crypto\").createHash(\"md5\")"' # Error: ... unsupported ``` ## Passwords [#fips-passwords] In FIPS mode, Langfuse hashes and verifies email/password credentials only with PBKDF2-HMAC-SHA256 (600,000 iterations), and never runs bcrypt. Passwords set before you turned on FIPS mode are stored as bcrypt hashes, which FIPS mode does not verify. Those users cannot sign in until they set a new password: - Sign-in fails with: `This instance runs in FIPS mode and your password must be reset.` - Users set a new password with the **forgot password?** link on the sign-in page. Password reset sends a code by email, so configure [transactional emails](/self-hosting/configuration/transactional-emails) before you turn on FIPS mode, or move users to [SSO](/self-hosting/security/authentication-and-sso). - Users who sign in with SSO are not affected. If you turn FIPS mode off later, PBKDF2 passwords keep working: instances without FIPS mode verify both formats and write bcrypt for new passwords. ## Known limitations [#fips-limitations] - **Legacy API keys:** API keys created by early Langfuse versions, before keys were hashed with SHA-256, are checked once with bcrypt on first use and then re-hashed with SHA-256. Rotate such keys to avoid bcrypt entirely. --- If you experience any issues when self-hosting Langfuse, please: 1. Check out [Troubleshooting & FAQ](/self-hosting/troubleshooting-and-faq) page. 2. Use [Ask AI](/docs/ask-ai) to get instant answers to your questions. 3. Ask the maintainers on [GitHub Discussions](/gh-support). 4. Create a bug report or feature request on [GitHub](/issues). Enterprise-grade support is available when self-hosting Langfuse. Learn more on our [pricing page](/pricing-self-host). --- ## Agent Instructions This page is part of the [Langfuse](https://langfuse.com) documentation, published as plain Markdown for AI agents. Every page is available as Markdown by appending `.md` to its URL, or by sending an `Accept: text/markdown` header. This page: `https://langfuse.com/self-hosting/configuration/fips-mode.md`. ### Querying these docs If the answer is not on this page, query the documentation instead of guessing: - **Semantic search** across all Langfuse docs, returning an answer with the relevant pages and excerpts. Ask a specific, self-contained question: ```bash curl -sG "https://langfuse.com/api/search-docs" --data-urlencode "query=How do I trace a LangGraph agent?" ``` - **Index of every page**: , with per-section indexes [llms-docs.txt](https://langfuse.com/llms-docs.txt), [llms-integrations.txt](https://langfuse.com/llms-integrations.txt), and [llms-self-hosting.txt](https://langfuse.com/llms-self-hosting.txt). ### Before writing Langfuse code - **Install the [Langfuse Agent Skill](https://langfuse.com/docs/api-and-data-platform/features/agent-skill).** It encodes Langfuse's own best practices for instrumentation, prompt management, and evaluation, and materially improves results. - **Read [What does a good trace look like?](https://langfuse.com/docs/observability/best-practices.md)** before instrumenting an application. - **Verify endpoints, parameters, and response fields** against the [API reference](https://api.reference.langfuse.com) instead of inferring them from code examples. - **Use the [Langfuse CLI](https://langfuse.com/docs/api-and-data-platform/features/cli)** (`npx @langfuse/cli api `) to read or write traces, prompts, datasets, and scores from the terminal. Found an error in these docs? Please open an issue at .