A public TLS observation can identify negotiated protocols, cipher suites, groups and presented certificates. It cannot identify the exact cryptographic module, validation certificate, version, operational environment or approved operating mode behind the endpoint.
What changes on September 22, 2026
The CMVP FAQ says that only FIPS 140-3 module validations remain on the active list from September 22, 2026. Historical status does not mean a certificate was revoked, but it changes how the validation may be used and must be interpreted with current program guidance.
Validation attaches to a specific module and configuration. NIST also warns that a product embedding a validated module is not automatically itself validated and that correct use of the embedded module is outside the module validation.
Evidence a module inventory needs
- CMVP certificate number and validation status.
- Module name, vendor, version or part number and applicable operational environment.
- Product-to-module relationship and vendor evidence for the embedded module.
- Configured approved mode and the cryptographic services actually used.
- Owner, system, data sensitivity, dependencies, supplier and replacement plan.
- Source, date, confidence and reviewer for every assertion.
Observed TLS is not inferred validation
Seeing TLS 1.3 or an approved algorithm at a public endpoint is useful protocol evidence, but it does not expose the underlying module identity or prove approved-mode operation. The correct inventory state is unknown until module-level documentation or local evidence is connected.
This boundary is useful: cryptographic discovery can identify where follow-up is needed without converting an observable protocol into an unsupported compliance conclusion.
Frequently asked questions
Does a historical FIPS 140-2 validation mean the module is revoked?
No. NIST distinguishes historical from revoked status. Teams must review current CMVP guidance and the specific validation entry for permitted use and transition decisions.
Can a TLS scan verify FIPS 140-3 validation?
No. A TLS scan cannot establish the module certificate, exact version, operational environment or approved operating mode.
What should Cipher Discovery report?
It should report the protocol and certificate facts it observed, leave module validation unknown, and recommend connecting module-level vendor or local evidence instead of claiming compliance.