Verify FIPS 140-2/140-3 operational status in ePO

To maintain a compliant environment, you must validate that the core Trellix ePO - On-prem components are operating strictly within the cryptographic boundary.

Important
The FIPS standard applicable to your environment depends on your ePO - On-prem version. ePO On-prem 5.10.0 SP1 through Update 6 supports FIPS 140-2.
Starting with SP1 Update 7, ePO On-prem supports FIPS 140-3. The verification steps in this topic apply to both standards; only the expected values differ, as noted below.

You must verify the configuration of the following three components to confirm they are correctly enforcing FIPS constraints and have disabled non-compliant "Mixed mode" operations:

Verify the Agent Handler status in FIPS mode

View the server.ini file to make sure that Agent Handler is running in FIPS mode.

Use a text editor to open the server.ini file.
The server.ini file is located in your ePO - On-prem installation directory: <epoinstalldirectory>\DB\server.ini
Look for the FipsMode value.
This value indicates the server operating mode:
- FipsMode=0 — The server is in Mixed (normal) mode. To put your server in FIPS mode, repeat the installation or upgrade process.
- FipsMode=1 — The server is in FIPS mode.

Verify the Apache Server configuration in FIPS mode

The Apache server contains a FIPS enablement configuration setting.

Browse to the Agent Handler installation folder. The default folder is C:\Program Files (x86)\Trellix\ ePolicy Orchestrator.
Browse to the Apache configuration folder: apache2\conf
Using a text editor, open the httpd.conf file and search for SSLFIPS.
- Off — Apache mod_ssl is not configured for FIPS enablement.
- On — Apache mod_ssl is configured for FIPS enablement.

Verify the Application Server in FIPS mode

View the Security Mode to make sure that the ePO - On-prem application server is running in FIPS mode.

Select Menu → Configuration → Server Settings → Security Keys, then confirm the Security Mode value:

FIPS 140-2 — if your ePO - On-prem version is SP1 Update 6 or earlier.
FIPS 140-3 — if your ePO - On-prem version is SP1 Update 7 or later.