.svg)
Available since: Rocket.Chat 8.7.0
Rocket.Chat is engineered for high-security environments, offering dedicated FIPS-compliant support to protect sensitive communications. This level of security is essential for government agencies, defense organizations, and heavily regulated industries that must comply with strict federal cryptographic standards.
What is FIPS ?
Federal Information Processing Standards (FIPS) are security standards developed by the U.S. National Institute of Standards and Technology (NIST). They define the mandatory security requirements for cryptographic modules used to protect sensitive data.
Rocket.Chat aligns with FIPS 140-3, the current standard for cryptographic module validation across government and enterprise sectors globally.
How FIPS works in Rocket.Chat
Rocket.Chat provides dedicated FIPS-compliant images that enforce FIPS compliance at the runtime layer. The images include FIPS-validated cryptographic modules, so security operations run in a FIPS-compliant configuration by default.
When you deploy a FIPS-compliant Rocket.Chat workspace:
Cryptographic operations use FIPS-approved algorithms, including AES, RSA, and SHA-256 or stronger.
Non-approved algorithms are excluded from the Rocket.Chat cryptographic boundary.
FIPS compliance is determined entirely by the image tag used during deployment. There is no toggle or configuration setting in the workspace UI to enable FIPS.
The workspace user interface and user experience remain unchanged.
Deploy a FIPS-compliant Rocket.Chat workspace
Rocket.Chat publishes FIPS-compliant images alongside every standard release, identified by the -fips tag suffix (for example, 8.7.0-fips). Both images follow the same release schedule, ensuring FIPS deployments receive product updates, security patches, and bug fixes simultaneously with the standard release track.
Organizations requiring FIPS compliance must deploy the dedicated FIPS image rather than the standard Rocket.Chat image.
Prerequisites
A premium plan license that includes the FIPS add-on. Contact the Rocket.Chat Sales team to get your license.
The FIPS image tag for the Rocket.Chat version you want to deploy. For example,
8.7.0-fipsis the FIPS image tag for Rocket.Chat 8.7.0. See Docker Hub for available image tags.
Configure your deployment for FIPS
Deploying a FIPS-compliant Rocket.Chat workspace follows the same deployment process as a standard self-managed deployment. The only required changes are:
Use the Rocket.Chat image tagged with the
-fipssuffix.Apply a license that includes the FIPS add-on.
Choose your deployment method below and continue with the following steps:
Follow the official Deploy with Kubernetes guide, and apply the required changes below during deployment.
In your
values.yamlfile:Update the image
tagto the desired-fipsrelease:image: repository: registry.rocket.chat/rocketchat/rocket.chat tag: <fips-docker-image-tag>Add the license:
license:"<license-key>"
Install Rocket.Chat with the configurations you defined in
values.yaml:helm install rocketchat -f values.yaml rocketchat/rocketchat -n rocketchatFor existing deployments, upgrade the deployment:
helm upgrade rocketchat -f values.yaml rocketchat/rocketchat -n rocketchat
Follow the official Deploy with Docker and Docker Compose guide, and apply the required changes below during deployment.
In your
.envfile, specify the-fipsrelease tag and your license key:RELEASE=<fips-docker-image-tag> ROCKETCHAT_LICENSE=<license-key>Launch the deployment stack and start the containers:
docker compose \ -f compose.monitoring.yml \ -f compose.traefik.yml \ -f compose.database.yml \ -f compose.yml \ -f compose.nats.yml \ -f docker.yml \ up -dFor existing deployments, restart the rocketchat container:
docker compose -f compose.yml up -d
Follow the official Deploy with Podman and Podman Compose guide, and apply the required changes below during deployment.
In your
.envfile, specify the-fipsrelease tag and your license key:RELEASE=<fips-docker-image-tag> ROCKETCHAT_LICENSE=<license-key>Launch the deployment stack and start the containers:
podman-compose \ -f compose.monitoring.yml \ -f compose.traefik.yml \ -f compose.database.yml \ -f compose.yml \ -f compose.nats.yml \ -f podman.yml \ up -dFor existing deployments, restart the rocketchat container:
docker compose -f compose.yml up -d
If you deploy without a valid license, the
rocketchatcontainer will log aFIPS LICENSE ERRORand fail to start.
Verify FIPS mode
After the workspace starts, verify that Rocket.Chat is running in FIPS mode before using it in a production environment.
View the Rocket.Chat container logs:
kubectl logs deployment/rocketchat-rocketchat -n rocketchat | grep -A 15 "SERVER RUNNING"View the Rocket.Chat container logs:
docker compose logs -f rocketchat View the Rocket.Chat container logs:
podman-compose logs -f rocketchat A successful FIPS deployment shows FIPS Provider: Enabled in the log output.
Known limitations
While core functionality remains unchanged, operating a FIPS-compliant Rocket.Chat workspace has the following limitations:
Platform support: FIPS Docker images are currently available only for AMD64 (x86_64) platforms.
Email direct reply: Email direct reply using POP3 servers that only support APOP or CRAM-MD5 authentication is not supported in FIPS mode because these authentication mechanisms rely on cryptographic algorithms that are not permitted in a FIPS-compliant deployment. If your organization uses POP3 email direct reply, ensure your mail server supports a compatible authentication method.
Bcrypt password hashing: Rocket.Chat continues to use Bcrypt for user password hashing to maintain backwards compatibility across deployments. While Bcrypt is widely recognized as a secure industry-standard hashing algorithm, it is not FIPS-validated. Migration plans are underway to transition password hashing in a future release to a FIPS-approved algorithm, such as PBKDF2.
If you have any questions, refer to FIPS Compliance FAQ for additional guidance.