Features and limitations of the SEM FIPS edition

The SEM FIPS edition, introduced in SEM 2026.4, runs on a customer-managed Red Hat Enterprise Linux (RHEL) host with FIPS mode enabled and uses only FIPS 140-3 validated cryptography. To meet FIPS requirements, some features are removed or work differently than in the SEM virtual appliance.

Use the following tables to plan a FIPS edition deployment.

Features removed in the FIPS edition

Feature	Details and alternatives
CMC console and cmc user	The CMC console and the cmc operating system user are not available. Use semcli and standard RHEL tools instead. See Use semcli on the SEM FIPS edition (RHEL). The cmc account is hidden in Configure > Users, and the System User filter is removed from the Users page.
CMC password change at first login	The first-login wizard does not include the CMC password-change screen.
Platform Connect and Anomaly Detection	Platform Connect is not available. The Anomalous Events screen, the Platform Connect update elements, and the Platform Connect status icon are removed. Anomaly Detection is not available.
SMB sharing	SMB sharing is removed from Settings > Sharing because the SMB library depends on a non-FIPS cryptographic provider. Use SFTP or Email sharing instead. See Set up SFTP connections to external systems.
Legacy agents	Legacy agents that use the old communication certificate are not supported. Non-FIPS agents cannot connect to a FIPS edition Manager. Use the FIPS agent installers.

Features that work differently in the FIPS edition

Feature	FIPS edition behavior
LDAP	LDAP connections must use LDAPS. See Configure LDAP for SEM.
Local user passwords	Passwords for local users must include at least 14 characters. The default admin password on a new installation is defaultPassword, and you must change it at first login.
Reset the admin account	Run semcli resetadmin on the RHEL host and enter the support key from the decoder site. See Use semcli on the SEM FIPS edition (RHEL).
RHEL root password	You manage the RHEL root password. SEM never sets, changes, or retrieves it. The root password value shown on the decoder site does not apply to FIPS edition hosts.
Network configuration	IPv4-only and dual-stack (IPv4 and IPv6) networks are supported. Configure networking with RHEL tools such as nmcli or nmtui, not with the CMC. See Configure IPv6 and dual-stack networking in SEM.
Internal databases	Internal databases use SQLite.
Certificates and keystores	Certificates should include a Subject Alternative Name (SAN). Keystores use the BCFKS format. Use semcli to export a certificate signing request, import a CA-signed certificate, or configure a self-signed certificate.
SNMPv3	SNMPv3 must use SHA authentication and AES privacy. MD5 and DES are rejected.
TLS	ChaCha20 cipher suites are removed. TLS connections use AES-GCM cipher suites.
SFTP and SCP	Non-FIPS algorithms are removed. Older SFTP servers that support only non-FIPS algorithms might not be able to connect.
Connector updates	To update connectors offline, copy the connectors ZIP file to /var/sem/connectors-update/offline. See Update connectors offline.
Kerberos single sign-on	See Set up single sign-on in SEM.

Features that work the same in the FIPS edition

The following features work the same way as in the SEM virtual appliance:

• Dashboard

• Live Events

• Historical Events and reports

• Rules

• Configure tab

• Threat Intelligence

• Licensing (online and offline activation)

• SFTP and Email sharing

• Log forwarding

• SolarWinds Improvement Program (SWIP)

• Dark Mode

• Query packs