IronPDF - Understanding FIPS Compliance: Compatible vs. Certified

Overview

This article explains IronPDF's posture on FIPS 140-2/140-3 for customers in regulated industries — government, healthcare, and financial services — who ask whether IronPDF is FIPS compliant or can run in environments where FIPS mode is enforced (e.g., Windows Group Policy "System cryptography: Use FIPS compliant algorithms," FedRAMP, HIPAA, PCI-DSS, or DoD IL environments). IronPDF does not implement its own cryptography; it delegates all cryptographic operations to the host platform's validated providers. This article covers the Compatible-vs-Certified distinction, what IronPDF delegates and to what, which scenarios work under FIPS mode, and how to respond if a customer or auditor asks for a formal compliance statement.

Version Metadata

• Minimum Version: N/A — applies to all versions
• Superseded-in Version: N/A

Steps

1. Understand the distinction between FIPS-Compatible and FIPS-Certified. These terms are often used interchangeably but mean very different things. FIPS-Certified means a specific cryptographic module has been submitted to NIST's Cryptographic Module Validation Program (CMVP), tested by an accredited laboratory, and issued a formal validation certificate — an expensive, time-consuming process that applies to cryptographic modules, not entire applications. FIPS-Compatible (sometimes called FIPS-compliant) means software can operate correctly in an environment where FIPS mode is enforced, typically by delegating all cryptographic operations to an already-certified module (e.g., the Windows OS kernel-mode cryptographic provider bcryptprimitives.dll, or OpenSSL's FIPS provider). IronPDF is FIPS-compatible but not FIPS-certified.
2. Confirm what IronPDF delegates, and to what. IronPDF does not implement its own cryptographic algorithms:
   • It relies on the underlying platform's cryptographic providers — .NET's System.Security.Cryptography (which delegates to OS-level FIPS-validated modules on Windows) or the JVM's security providers on Java.
   • When Windows FIPS mode is enabled via Group Policy, IronPDF continues to function normally because it does not call any non-FIPS algorithms directly.
   • IronPDF's internal Chromium rendering engine uses BoringSSL for TLS connections (e.g., when rendering URLs or loading remote assets). BoringSSL is not FIPS-certified by default — Google maintains a separate FIPS-validated build of BoringCrypto, but IronPDF's bundled Chromium uses the standard BoringSSL build, not that FIPS-validated variant.
   • For PDF encryption and digital signatures, IronPDF delegates to .NET's built-in cryptographic APIs, which respect the OS-level FIPS policy.
3. Check which customer scenarios work under FIPS mode. Use this table when a customer asks about a specific workflow:
   

   Scenario	Works in FIPS Mode?	Notes
   HTML string → PDF rendering	Yes	No external TLS required
   URL → PDF rendering (HTTPS)	Conditional	Chromium's BoringSSL handles TLS — not FIPS-validated, but uses AES-GCM/SHA-256, which are FIPS-approved algorithms
   PDF encryption (AES-128/256)	Yes	Delegates to .NET System.Security.Cryptography
   Digital signatures (X.509)	Yes	Delegates to .NET System.Security.Cryptography
   PDF reading/writing (no crypto)	Yes	No cryptographic operations involved

4. If strict certification of every binary in the stack is a hard requirement (rare outside DoD IL4+ environments), flag that the embedded Chromium's BoringSSL module is not independently FIPS-certified. In that case, recommend setting IronPdf.Installation.ChromeGpuMode = IronPdf.ChromeGpuModes.Disabled and rendering from HTML strings rather than live URLs where possible, to minimize the TLS dependency.
5. Important points about FIPS:
   • IronPDF does not contain a standalone cryptographic module and therefore is not subject to CMVP validation itself.
   • All cryptographic operations are delegated to the host platform's FIPS-validated providers (Windows CNG / .NET cryptographic stack).
   • This delegation model is the same approach used by most application-level libraries and frameworks, including ASP.NET Core itself.