Buying this quarter? Read the sunset date, not the standard

There are 703 active FIPS 140-3 certificates held by 311 vendors. 651 of them still run past September 2028. 52 do not — and a specification that says only “must be FIPS 140-3 validated” cannot tell the two apart.

• 703active FIPS 140-3 certificates
• 311vendors holding one
• 52end within two years of the cliff

If you are buying Windows machines

This is the most common version of the question, and it has an uncomfortable answer. A Windows build’s FIPS posture rests on two modules — bcryptprimitives.dll and cng.sys. A build with other modules validated but not those two is not the same as a covered build.

Read the Core modules column. The newest releases with an active core pair are Windows 11 22H2 (10.0.22621) and Windows Server 2022 (10.0.20348), which gained FIPS 140-3 certificates on 31 August 2026 for the exact builds those certificates name. Windows 11 22H2 is past Microsoft’s end of servicing (Enterprise and Education ended 14 October 2025), so no Windows 11 release Microsoft still services is named on a certificate; Server 2022 is supported to 14 October 2031. Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2 and 26H1, and Server 2025 have no active core certificate in this snapshot. That is not a reason to avoid them; it is a reason to know before you write the specification, because “latest” and “validated” are currently pulling in opposite directions and the gap has to be documented either way.

An active core pair is not the end of the question — read the scope too. Windows Server 2019 is the sharpest example on this table: its certificates name two exact revisions and cover Server Core only, so a Server 2019 on any other revision, or with the desktop experience installed, sits outside them. A certificate number on its own cannot tell you that, which is why the notes are here.

The table starts at the oldest release that still carries an active core certificate and shows everything newer; older releases are assessed in full by the report rather than listed here.

Search any vendor

Every active FIPS 140-3 certificate, with its end date. Type a vendor or a product name.

Filter by vendor, module or certificate number

The 52 to look at twice

These are validated today and their standing ends within two years of the cliff. Buying one is not a mistake — it is a decision that should be made knowingly, with the end date written into the risk register next to it rather than discovered later.

Where the deepest benches are

Vendors by how many active FIPS 140-3 certificates they hold, and how many of those run past September 2028. A long bench is not a recommendation of any product — it says the vendor is demonstrably still in the program, which is a different and more durable fact than any single certificate.

What this page is not

It is not a product recommendation, a security assessment, or a statement that anything absent from it is unvalidated. It is one public record, rearranged so that the end date is impossible to miss. The purchasing decision, and everything else that goes into it, stays yours.