How to Enable FIPS Mode on SUSE Linux Enterprise Server 15

On SUSE Linux Enterprise Server 15, use SUSE’s fips-mode-setup workflow to configure the FIPS crypto policy and boot settings, then reboot and verify the result. Do not treat a single kernel flag as proof of compliance: FIPS mode is only one part of a compliant deployment, and the validated cryptographic modules and package versions must match the requirement that applies to your system.

This procedure follows the SUSE Security and Hardening Guide for SLES 15 SP7, the current SLES 15 service pack documentation reviewed on October 6, 2026. Package availability and certification status can vary by service pack, architecture, repository, and support contract.

Quick reference

Before you enable FIPS mode

FIPS 140 validates cryptographic modules and their approved configurations; it is not a general security rating for an entire server. Confirm the exact SLES service pack, architecture, cryptographic modules, and applications that your compliance authority requires. SUSE’s SLES 15 SP7 guide states that SP7 will not be submitted for NIST FIPS 140-3 certification. The guide also notes that certification can involve specific binaries and versions. Therefore, enabling the mode on SP7 does not establish that the operating system or every application is FIPS 140-3 certified. Check SUSE’s current certification information and your assessor’s requirements before making a compliance claim.

SUSE recommends enabling FIPS only when a compliance rule requires it. FIPS restrictions can reject older algorithms or cause applications and integrations to stop working; updates may also affect functionality. Test a representative system first. Schedule downtime, ensure you have console or out-of-band access, confirm a current backup, and document a recovery route. If the server is remote, verify that you can access its boot console before changing boot configuration.

Enable FIPS mode on an installed SLES 15 system

1. Confirm the service pack and repositories

Record the platform details and verify that the server can reach its supported SUSE repositories:

cat /etc/os-release
uname -m
sudo zypper refresh

Check that the repository configuration matches the registered SLES product and service pack. Do not add an unrelated repository to obtain a similarly named package; certification depends on the right vendor packages, versions, and configuration.

2. Install the FIPS pattern and setup utility if needed

SUSE recommends installing the patterns-base-fips pattern on a new installation. On an existing server, review the pattern and package changes before confirming the transaction. The command that provides fips-mode-setup is supplied by crypto-policies-scripts and may not be installed by default. With the correct SLES repositories enabled, install the required components if they are missing:

sudo zypper install patterns-base-fips crypto-policies-scripts

If your service pack presents the FIPS pattern through YaST Software, you can select it there and install the setup package from the supported repository. Review zypper’s proposed dependency changes; stop if they would remove required packages or switch the system to unsupported sources.

3. Enable FIPS configuration

Run the SUSE-provided command as root through sudo:

sudo fips-mode-setup --enable

The utility configures the system policy and boot settings. SUSE’s documented example reports that the system policy is being set to FIPS and asks for a reboot. If the command reports that the utility is missing, install or repair crypto-policies-scripts from the correct product repository rather than manually editing assorted crypto-policy files.

For change-controlled environments that manage bootloader configuration separately, the utility supports --no-bootcfg. That option prints the boot parameters that need to be added instead of reconfiguring the bootloader. Follow the output and your platform’s bootloader procedure. SUSE notes an exception for IBM Z: the command still attempts to run zipl because omitting it could leave the system unbootable.

4. Reboot and verify

Reboot in the maintenance window:

sudo reboot

After the server comes back, check the complete status:

sudo fips-mode-setup --check

On SLES 15 SP7, SUSE’s example output confirms that FIPS mode is enabled, the initramfs FIPS module is enabled, and the current crypto policy is based on the FIPS policy. You can also inspect the kernel indicator:

cat /proc/sys/crypto/fips_enabled

A value of 1 indicates that the kernel FIPS flag is active. Treat this as an additional diagnostic, not a replacement for fips-mode-setup --check or a review of the validated modules and application configuration. A service might have its own cryptographic library, policy, or compliance requirements.

Check applications and integrations

Run functional tests that reflect the system’s actual role. Test TLS connections to required peers, SSH access with approved algorithms, certificate operations, scheduled jobs, backups, directory authentication, and any database or application cryptography. Review application logs for errors indicating that an algorithm or key size is unavailable. Update clients or integrations that depend on disallowed cryptography through their supported configuration process.

Samba/CIFS is a known consideration in SUSE’s guide: in a FIPS-compliant network, use Kerberos authentication. The guide explains that other Samba authentication modes include MD5, which is not supported for authentication under FIPS rules. Confirm the authentication path with your directory and storage administrators before switching production systems.

Troubleshooting checkpoints

• The command is not found: install crypto-policies-scripts from the registered SLES repositories, then retry.
• The check reports an inconsistent state: review the boot command line, initramfs status, and crypto policy together. Do not rely only on /proc/sys/crypto/fips_enabled.
• The system does not boot cleanly: use the console or your documented recovery method and restore the previous boot configuration. Investigate service-pack-specific support guidance before trying manual kernel parameters.
• An application stops connecting: identify the rejected protocol, algorithm, key size, or library. Update the peer or application to an approved configuration; do not weaken the system policy to silence the error without compliance approval.

Disable FIPS mode when the requirement changes

If you need to roll back, SUSE documents this command:

sudo fips-mode-setup --disable

Reboot afterward, then run sudo fips-mode-setup --check to confirm the resulting state. Disabling FIPS mode does not automatically undo every application, key, or configuration change made during a migration. Review those separately and document the final system state.

Practical completion checklist

• The SLES service pack and architecture are recorded, and their certification status matches the actual compliance requirement.
• The FIPS pattern and setup utility came from the supported repositories for that product.
• fips-mode-setup --enable completed, the server rebooted, and fips-mode-setup --check reports the expected components active.
• Application, network, SSH, backup, and authentication tests passed with the approved algorithms.
• The exact validated modules, binaries, package versions, and operational evidence have been reviewed with the compliance owner.

Official references

• SUSE SLES 15 SP7 Security and Hardening Guide: Enabling compliance with FIPS 140-3
• SUSE SLES 15 SP5 Security and Hardening Guide: FIPS status and setup
• SUSE SLES 15 GA Release Notes: libica FIPS 140-2 mode and the fips=1 parameter
• SUSE security certifications and validated products
• NIST Cryptographic Module Validation Program