---
title: "Enabling FIPS with the pro tool\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/certifications/docs/fips-enablement?format=md
keywords: index, follow
---

*Submit*

Version 24.04
Version 22.04
Version 20.04
Version 16.04 / 18.04

# Enabling FIPS with the pro tool

FIPS configuration can be enabled automatically via the Ubuntu Advantage tool [after attaching your subscription](https://ubuntu.com/server/docs/install/subscription). To install the tool type the following commands.

```
sudo apt update
sudo apt install ubuntu-advantage-tools
```

## Attach the subscription

---

**NOTE:** This step is not necessary in Ubuntu PRO images.

---

The FIPS packages are available on Ubuntu Pro or with an [Ubuntu Advantage subscription](https://ubuntu.com/advantage). To attach your subscription follow the steps on [the official Ubuntu guide](https://ubuntu.com/server/docs/install/subscription).

## Enable FIPS

---

**NOTE:** Switching the system to contain the FIPS certified packages cannot be easily undone. We recommend to use a testing system for experimentation before trying on production.

---

We recommend [enabling the ‘fips-updates’ option](https://ubuntu.com/security/certifications/docs/16-18/fips-updates) that includes security fixes timely before the packages are re-certified. However we provide the option to install the validated packages that are only updated on re-validation.

### Including timely security updates

1. Enable FIPS including security updates.
   `sudo pro enable fips-updates`
2. Verify that the system is attached to pro and has FIPS enabled.
   `sudo pro status`
3. Please proceed to the [reboot](https://ubuntu.com/security/certifications/docs/16-18/fips#heading--reboot) section.

### Strictly with the certified packages

1. Enable FIPS.
   `sudo pro enable fips`
2. Verify that the system is attached to pro and has FIPS enabled.
   `sudo pro status`
3. Please proceed to the [reboot](https://ubuntu.com/security/certifications/docs/16-18/fips#heading--reboot) section.

### Reboot

The pro client will install the necessary packages for the FIPS mode, including the kernel and the bootloader. After this step you MUST reboot to put the system into FIPS mode. The reboot will boot into the FIPS-supported kernel and create the `/proc/sys/crypto/fips_enabled` entry which tells the FIPS certified modules to run in FIPS mode. If you do not reboot after installing and configuring the bootloader, FIPS mode is not yet enabled.

To verify that FIPS is enabled after the reboot check the `/proc/sys/crypto/fips_enabled` file and ensure it is set to 1. If it is set to 0, the FIPS modules will not run in FIPS mode. If the file is missing, the FIPS kernel is not installed, you can verify that FIPS has been properly enabled with the `pro status` command.

## FIPS and livepatching

The Livepatch service is enabled by default while attaching the system to the Ubuntu Advantage service. Livepatch and the `fips` stream are not compatible, so it will be disabled. Livepatch is available on the `fips-updates` stream.

---

[Previous

FIPS 140](https://ubuntu.com/security/certifications/docs/fips)
[Next

Security patching](https://ubuntu.com/security/certifications/docs/fips-updates)

This page was last modified 3 years ago. [Help improve this document in the forum](https://discourse.ubuntu.com/t/enabling-fips-with-the-pro-tool/24743).