The DBMS must be configured on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL.

From PostgreSQL 9.x Security Technical Implementation Guide

Associated with: CCI-000803

SV-87723r2_rule The DBMS must be configured on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL.

Vulnerability discussion

Postgres uses OpenSSL for the underlying encryption layer. Currently only Red Hat Enterprise Linux is certified as a FIPS 140-2 distribution of OpenSSL. For other operating systems, users must obtain or build their own FIPS 140-2 OpenSSL libraries.

Check content

If the deployment incorporates a custom build of the operating system and PostgreSQL guaranteeing the use of FIPS 140-2- compliant OpenSSL, this is not a finding. If PostgreSQL is not installed on Red Hat Enterprise Linux (RHEL), this is a finding. If FIPS encryption is not enabled, this is a finding.

Fix text

Install PostgreSQL with FIPS-compliant cryptography enabled on RHEL; or by other means ensure that FIPS 140-2-certified OpenSSL libraries are used by the DBMS.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.