FIPS 140-3 Support for Kong Gateway: Secure Compliance

Kong Gateway now offers FIPS 140-3–validated builds alongside its existing FIPS 140-2 artifacts, allowing organizations in federally regulated, financial, healthcare, and PCI-governed environments to adopt the newer cryptographic standard without disrupting current deployments. FIPS 140-3, administered through NIST and Canada’s CCCS Cryptographic Module Validation Program, supersedes 140-2 with alignment to ISO/IEC 19790 and stricter requirements for testing, attack mitigation, and lifecycle assurance. Kong’s new build uses the FIPS 140-3–validated OpenSSL 3.1.2 provider, supports TLS 1.3 as well as TLS 1.2, applies a narrower set of modern TLS 1.2 cipher suites, and centralizes FIPS state and cryptographic policy across deployment environments and signing features. The release also rejects weak keys and unsupported EdDSA defaults in FIPS mode, while treating post-quantum TLS as a separate non-FIPS feature that is disabled with a warning when FIPS mode is active. Existing users can remain on FIPS 140-2, while those moving to the new standard can select the dedicated `-fips-140-3` package or image without changing their gateway architecture.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.