The FIPS 140-2 sunset happened: 481 certificates became Historical on 21 September 2026

Published 2026-09-22.

It happened. On 21 September 2026 the FIPS 140-2 certificates still listed as Active moved to the CMVP Historical list. Our re-read that day recorded 481 certificates changing status. As of 22 September 2026, CMVP's Active FIPS 140-2 list returns "No certificates match the search criteria" — the column is empty, and no new FIPS 140-2 certificate can ever be issued to refill it.

NIST published no per-certificate notice. The status simply changed on the register, as it always does.

If you hold a FIPS 140-2 certificate, it is now Historical. That is not the same as revoked, and nothing stopped working on the 21st — see "What Historical actually means" below. You can check your own certificate numbers against the register.

The register today

The full CMVP register, re-read 2026-09-22 and verified row-by-row against the listing pages (method):

The FIPS 140-2 Active column went to zero and the Historical column absorbed it — the largest single status change this register will ever have. The 481 that flipped on the day were held disproportionately by the vendors federal buyers know best: Microsoft (24 certificates), Oracle (14), Google (12), Red Hat (11), Thales (10), Cisco and FireEye (9 each), Samsung and Entrust (8 each). By module type they split 224 software, 210 hardware, 22 software-hybrid, 16 firmware and 9 firmware-hybrid. 14 of the 481 rows carry no vendor name at all — that is NIST's own gap, published as empty cells on the register.

The 11 that went early — and did

Before the transition this page listed 11 certificates whose own five-year mark fell *before* 21 September, and warned that every explainer giving the single date was wrong for those holders by up to three weeks. All 11 went early, exactly as their own certificate pages said they would. Each is Historical today:

That is the difference between reading the programmatic date and reading each certificate's own page.

We watched the register move throughout. On 13 August this page said 503 were Active and listed 19 going early. Thirteen days later 29 certificates had silently changed status — 10 FIPS 140-2 and 18 FIPS 140-3 moved to Historical, and 43 new ones appeared. Eight of the 19 we had listed were already gone, and their pages had stopped printing a sunset date altogether. CMVP announced none of it, and our own snapshot was 13 days old and wrong. That is why the checking cadence here is weekly, and it is why the flip itself was caught on the day rather than a fortnight later.

September is not the end of it

The sunset is usually described as a one-off event. It was the largest step in a rolling process that has not stopped: every FIPS 140-3 certificate also expires five years after its own validation, each on its own date. Across the 710 certificates still Active there are 303 distinct sunset dates, and 38 of them expire in the twelve months after 21 September 2026 — the next is certificate 4812 on 23 September 2026, two days after the transition. A module validated today gets a date in 2031; the furthest out is 5526 on 16 September 2031.

That is why this dataset records the date per certificate rather than as a footnote about September: the question "when does mine expire" has 303 different answers, and 9/21/2026 is no longer one of them.

What Historical actually means

CMVP's own definition, from the validated-modules page:

If a validation certificate is marked as historical, Federal Agencies should not include these in new systems but can be procured for legacy systems. This does not mean that the overall FIPS-140 certificates for these modules have been revoked, rather it indicates that the certificates and the documentation posted with them are either more than 5 years old, or were moved to the Historical list because of programmatic transitions.

Two things follow from that wording. First, Historical is not Revoked — a module on the Historical list was not found deficient, and agencies "may make a risk determination on whether to continue using" it. A module whose certificate moved on the 21st is the same module it was on the 20th. Second, the practical bite is on new procurements: a product whose FIPS validation rests on a 140-2 certificate no longer satisfies a requirement for a currently-listed module in a new system. The successor path is FIPS 140-3, where 710 certificates are Active today.

One caution when you go looking for that successor. The register keeps whatever vendor name was on the original validation, so an acquisition hides the replacement completely: all 22 of FireEye's certificates are Historical and nothing is Active under "FireEye", yet those modules are validated today under Trellix (8 Active) and Musarubra US LLC (2 Active). Search by the vendor's current name before concluding a module has nowhere to go.

Why the change was easy to miss

The status change is silent. CMVP updates the register but announces nothing per certificate, and the register itself is reachable only through advanced-search query strings — there is no stable per-certificate page carrying the status in prose an assistant can quote. An assistant answering "is certificate X still active?" from training data will keep saying yes for months, and after 21 September it will do that for every FIPS 140-2 certificate in existence. That is the gap this snapshot exists to close.

Both sides of it, preserved and checkable

We hold the complete register before and after — all 5,520 certificates, every record carrying the CMVP listing URL it was read from and the verbatim register row as its quote, 100% of claims substring-confirmed against those pages. The changes feed carries the flip as data: which certificates moved, and when we verified it.

• Check your certificate numbers — paste the numbers from a package, get each one's status and expiry date
• The dataset — one page per certificate, with source and quote
• data.json — the full register, machine-readable
• changes.xml — poll this to watch the rolling 140-3 expiries
• How the records are made and checked

Every figure on this page is computed from those records; nothing here is estimated. If a number looks wrong, the record it came from links the page that states it — check us.