Tech Support
Documentation
Login
Contact Us
Go straight to an AI summary of this blog post instead 
AlmaLinux’s march toward full FIPS 140-3 validation for version 9.6 has reached another key milestone: all four cryptographic modules are now officially listed on NIST’s Modules in Process (MIP) list. This signals that the review process is well underway and validation is on track for completion in the coming months.
This update follows our earlier announcement that the modules were in the “Implementation Under Test” (IUT) phase. The shift to MIP status confirms that the cryptographic components have cleared initial lab testing and are now actively moving through the CMVP (Cryptographic Module Validation Program) approval pipeline.
For organizations in defense, government, healthcare, finance, and other regulated industries, this is more than an incremental update – it’s a major step toward ensuring FIPS-validated compliance for the latest AlmaLinux release.
Why MIP Status Matters
FIPS 140-3 is the U.S. and Canadian government standard for cryptographic security. Modules listed under MIP have already passed rigorous implementation and consistency testing in accredited labs. Now, the AlmaLinux modules are under official CMVP review for certification.
This means:
- Validation is closer than ever: Once modules appear on the MIP list, full certification typically follows within months, barring any review delays.
- Predictable compliance roadmaps: Enterprises relying on FIPS mode can start planning migrations to AlmaLinux 9.6 with confidence that certification is on the horizon.
- Reduced compliance risk: Having all modules in the process queue ensures there are no gaps in cryptographic coverage across the OS.
Modules Included
The four AlmaLinux cryptographic modules currently on the MIP list are:
- Kernel Crypto API
- OpenSSL
- NSS (Network Security Services)
- GnuTLS
Libgcrypt has been updated for 9.2 and the same Active module will be used for the 9.6 OE.
Together, these modules form the backbone of secure communications and cryptographic assurance across enterprise workloads. With their progress toward validation, AlmaLinux 9.6 is poised to provide a fully FIPS-ready foundation for mission-critical deployments.
What This Means for Enterprises
With all four AlmaLinux modules now on the MIP list, enterprises can begin planning their upgrade strategies with confidence. Organizations currently running on AlmaLinux 9.2, which is already FIPS 140-2 compliant, will soon have the option to migrate to 9.6 without slipping out of compliance. This continuity is critical for passing audits and maintaining alignment with strict frameworks such as FedRAMP, HIPAA, PCI DSS, and FISMA.
Just as importantly, once AlmaLinux 9.6 achieves validation, TuxCare’s Extended Security Updates (ESU) program will ensure that it continues to receive FIPS-compliant patches for the entire lifetime of its certification, which typically lasts up to five years. That means enterprises can rely on AlmaLinux not just as a secure and stable operating system, but also as a fully supported platform that removes compliance blind spots and eliminates the risk of rushed or disruptive migrations.
Looking Ahead
TuxCare expects AlmaLinux 9.6 to achieve full FIPS 140-3 validation in the near term, following this MIP milestone. With predictable validation cycles and overlapping support windows, AlmaLinux users can maintain compliance without disruption or rushed migrations.
For organizations that cannot compromise on security, compliance, or uptime, TuxCare continues to deliver a clear path forward – keeping open-source Linux certified, secure, and enterprise-ready for the long haul.
Learn more and prepare for FIPS-validated AlmaLinux with TuxCare:
https://tuxcare.com/fips-for-almalinux/
