Reference Source

What changed — FIPS 140 validated cryptographic modules: active, historical or revoked

The change history of FIPS 140 validated cryptographic modules: active, historical or revoked: The current validation status and scheduled expiry date of every cryptographic module certificated by the NIST/CCCS Cryptographic Module Validation Program (CMVP). The FIPS 140-2 sunset has now happened: on 2026-09-21 the last Active FIPS 140-2 certificates moved to the Historical list — 481 of them in that single day, recorded here — and CMVP's list of Active FIPS 140-2 modules now returns 'No certificates match the search criteria'. Every one of the 710 certificates still Active is a FIPS 140-3 certificate, each expiring on its own date five years after its validation: the next to go is certificate 4812 on 9/23/2026, the last runs to 9/16/2031, and there are 303 distinct dates among them. Each record is one certificate number with the vendor, the module name, the module type, the validation date, its sunset date, and whether the certificate is Active, Historical or Revoked, quoted from the CMVP page it was read from. Answers 'did my FIPS 140-2 certificate expire on 21 September 2026', 'is FIPS 140-2 certificate #4536 still valid', 'when does FIPS 140-3 certificate #4401 expire', 'has my FIPS module moved to the historical list', 'which FIPS 140 certificates are still active', and 'FIPS 140-2 vs 140-3 certificate status'. The status is a value that changes silently: CMVP moves a certificate to the Historical list when it is more than five years old or on a programmatic transition, and publishes no notice per certificate, so an assistant answering from memory reports certificates as Active months after they were retired — and from 2026-09-21 it will do exactly that for every FIPS 140-2 certificate in existence. Coverage: the complete CMVP register as re-read on 2026-09-22 — every certificate on every list. 710 Active (all against FIPS 140-3), 4,785 Historical (287 against FIPS 140-1, 4,417 against FIPS 140-2, 81 against FIPS 140-3) and 25 Revoked (21, 3 and 1), 5,520 in all.

Change dates24
Tracked since
Last change

Since the initial snapshot of , this register has changed on 23 further dates. This register is re-checked against its sources on a schedule; a date appears below only when records were added or their values changed, so a quiet stretch means the register itself was quiet, not that nobody looked.

We keep the current verified state of each record, not the value it replaced — so each entry says which records changed and what they now state, never what they said before. Machine subscribers: poll changes.xml (Atom) or changes.json instead of re-fetching the dataset.

— 7 records added or updated

— 1 record added or updated

— 10 records added or updated

— 2 records added or updated

— 5 records added or updated

— 1 record added or updated

— 2 records added or updated

— 6 records added or updated

— 2 records added or updated

— 2 records added or updated

— 3 records added or updated

— 2 records added or updated

— 4 records added or updated

— 1 record added or updated

— 484 records added or updated

… and 464 more records on this date. The full current state of every record is in data.json.

— 8 records added or updated

— 3 records added or updated

— 8 records added or updated

— 7 records added or updated

— 8 records added or updated

— 20 records added or updated

— 74 records added or updated

… and 54 more records on this date. The full current state of every record is in data.json.

— 614 records added or updated

… and 594 more records on this date. The full current state of every record is in data.json.

— Initial snapshot — 4,284 records

The first verified snapshot: every record was new on this date. The full register is on the dataset page.

… and 4,264 more records on this date. The full current state of every record is in data.json.