FortiGate-VM 7.2/7.4

{
  "_type": "sec_certs.sample.fips.FIPSCertificate",
  "cert_id": 5563,
  "dgst": "874ed62968b0bdda",
  "heuristics": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.Heuristics",
    "algorithms": {
      "_type": "Set",
      "elements": [
        "TLS v1.2 KDF RFC7627A6833",
        "ECDSA SigVer (FIPS186-5)A6833",
        "RSA SigGen (FIPS186-5)A6833",
        "HMAC-SHA2-256A6833",
        "SHA-1A6833",
        "#A6833",
        "SHA3-256A4977",
        "Safe Primes Key GenerationA6833",
        "SHA2-256A6833",
        "HMAC-SHA2-384A6833",
        "KAS-FFC-SSC Sp800-56Ar3A6833",
        "RSA SigVer (FIPS186-5)A6833",
        "SHA2-512A6833",
        "#A6831",
        "KDF IKEv1A6833",
        "KAS-ECC-SSC Sp800-56Ar3A6833",
        "KDF IKEv2A6833",
        "#A6800",
        "SHA2-224A6833",
        "SHA2-384A6833",
        "RSA KeyGen (FIPS186-5)A6833",
        "#A6832",
        "HMAC-SHA-1A6833",
        "ECDSA KeyGen (FIPS186-5)A6833",
        "AES-CBCA6833",
        "TLS v1.3 KDFA6833",
        "HMAC-SHA2-512A6833",
        "KDF SSHA6833",
        "AES-GCMA6833",
        "ECDSA SigGen (FIPS186-5)A6833",
        "Counter DRBGA6831",
        "#A4977",
        "HMAC-SHA2-224A6833"
      ]
    },
    "cpe_matches": null,
    "direct_transitive_cves": null,
    "extracted_versions": {
      "_type": "Set",
      "elements": [
        "7.2",
        "7.4"
      ]
    },
    "indirect_transitive_cves": null,
    "module_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "module_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "policy_processed_references": {
      "_type": "sec_certs.sample.certificate.References",
      "directly_referenced_by": null,
      "directly_referencing": null,
      "indirectly_referenced_by": null,
      "indirectly_referencing": null
    },
    "policy_prunned_references": {
      "_type": "Set",
      "elements": []
    },
    "related_cves": null,
    "verified_cpe_matches": null
  },
  "pdf_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.PdfData",
    "br1_deviations": 2,
    "br1_tables": {
      "_type": "sec_certs.heuristics.br1.table_parsing.model.br1_tables.BR1Tables",
      "approved_algorithms": {
        "entries": [
          {
            "algorithm": "AES-CBC",
            "cavpCertName": "A6800, A6831, A6832, A6833",
            "properties": "Direction - Decrypt, Encrypt Key Length - 128, 192, 256",
            "reference": "SP 800-38A"
          },
          {
            "algorithm": "AES-GCM",
            "cavpCertName": "A6800, A6831, A6832, A6833",
            "properties": "Direction - Decrypt, Encrypt IV Generation - External IV Generation Mode - 8.2.1 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 16, 128, 136, 256, 264 AAD Length - AAD Length: 0, 128, 136, 256",
            "reference": "SP 800-38D"
          },
          {
            "algorithm": "Counter DRBG",
            "cavpCertName": "A6800, A6831",
            "properties": "Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0-256 Increment 256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0-256 Increment 256 Returned Bits - 256",
            "reference": "SP 800-90A Rev. 1"
          },
          {
            "algorithm": "ECDSA KeyGen (FIPS186-5)",
            "cavpCertName": "A6832, A6833",
            "properties": "Curve - P-256, P-384, P-521 Secret Generation Mode - extra bits, testing candidates",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigGen (FIPS186-5)",
            "cavpCertName": "A6832, A6833",
            "properties": "Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Component - No",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "ECDSA SigVer (FIPS186-5)",
            "cavpCertName": "A6832, A6833",
            "properties": "Component - No Curve - P-256, P-384, P-521 Hash Algorithm - SHA2-256, SHA2-384, SHA2-512",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "HMAC-SHA-1",
            "cavpCertName": "A6832, A6833",
            "properties": "MAC - MAC: 32-160 Increment 8 Key Length - Key Length: 8-1024 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-224",
            "cavpCertName": "A6832, A6833",
            "properties": "MAC - MAC: 32-224 Increment 8 Key Length - Key Length: 8-1024 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-256",
            "cavpCertName": "A6832, A6833",
            "properties": "MAC - MAC: 32-256 Increment 8 Key Length - Key Length: 8-1024 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-384",
            "cavpCertName": "A6832, A6833",
            "properties": "MAC - MAC: 32-384 Increment 8 Key Length - Key Length: 8-1024 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "HMAC-SHA2-512",
            "cavpCertName": "A6832, A6833",
            "properties": "MAC - MAC: 32-512 Increment 8 Key Length - Key Length: 8-1024 Increment 8",
            "reference": "FIPS 198-1"
          },
          {
            "algorithm": "KAS-ECC-SSC Sp800-56Ar3",
            "cavpCertName": "A6832, A6833",
            "properties": "Domain Parameter Generation Methods - P-256, P-384, P-521 Scheme - ephemeralUnified - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KAS-FFC-SSC Sp800-56Ar3",
            "cavpCertName": "A6832, A6833",
            "properties": "Domain Parameter Generation Methods - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP-2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192 Scheme - dhEphem - KAS Role - initiator, responder",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "KDF IKEv1 (CVL)",
            "cavpCertName": "A6832, A6833",
            "properties": "Authentication Method - Digital Signature, Pre-shared Key, Public Key Encryption Initiator Nonce Length - Initiator Nonce Length: 64-2048 Increment 8 Responder Nonce Length - Responder Nonce Length: 64-2048 Increment 8 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224-8192 Increment 8 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512 Preshared Key Length - Preshared Key Length: 8-8192 Increment 8",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF IKEv2 (CVL)",
            "cavpCertName": "A6832, A6833",
            "properties": "Initiator Nonce Length - Initiator Nonce Length: 64-128 Increment 8 Responder Nonce Length - Responder Nonce Length: 64-128 Increment 8 Diffie-Hellman Shared Secret Length - Diffie-Hellman Shared Secret Length: 224-8192 Increment 8 Derived Keying Material Length - Derived Keying Material Length: 160-16384 Increment 8 Hash Algorithm - SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "KDF SSH (CVL)",
            "cavpCertName": "A6832, A6833",
            "properties": "Cipher - AES-128, AES-192, AES-256 Hash Algorithm - SHA-1, SHA2-256",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "RSA KeyGen (FIPS186-5)",
            "cavpCertName": "A6832, A6833",
            "properties": "Key Generation Mode - probable Modulo - 2048, 3072, 4096 p mod 8 - 0 Primality Tests - 2powSecStr q mod 8 - 0 Info Generated By Server - No Private Key Format - standard Public Exponent Mode - random",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigGen (FIPS186-5)",
            "cavpCertName": "A6832, A6833",
            "properties": "Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A6832",
            "properties": "Hash Pair - Hash Algorithm - SHA2-224 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Public Exponent Mode - random Mask Function - MGF1",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "RSA SigVer (FIPS186-5)",
            "cavpCertName": "A6833",
            "properties": "Hash Pair - Hash Algorithm - SHA2-256 Salt Length - 32 Mask Function - MGF1 Modulo - 2048, 3072, 4096 Signature Type - pkcs1v1.5, pss Public Exponent Mode - random",
            "reference": "FIPS 186-5"
          },
          {
            "algorithm": "Safe Primes Key Generation",
            "cavpCertName": "A6832, A6833",
            "properties": "Safe Prime Groups - ffdhe2048, ffdhe3072, ffdhe4096, ffdhe6144, ffdhe8192, MODP- 2048, MODP-3072, MODP-4096, MODP-6144, MODP-8192",
            "reference": "SP 800-56A Rev. 3"
          },
          {
            "algorithm": "SHA-1, SHA2-224, SHA2-256, SHA2-384, SHA2-512",
            "cavpCertName": "A6832, A6833",
            "properties": "Message Length - Message Length: 0-65528 Increment 8",
            "reference": "FIPS 180-4"
          },
          {
            "algorithm": "SHA3-256",
            "cavpCertName": "A4977",
            "properties": "Message Length - Message Length: 0-65536 Increment 8",
            "reference": "FIPS 202"
          },
          {
            "algorithm": "TLS v1.2 KDF RFC7627 (CVL)",
            "cavpCertName": "A6832, A6833",
            "properties": "Hash Algorithm - SHA2-256, SHA2-384, SHA2-512 Key Block Length - Key Block Length: 1024",
            "reference": "SP 800-135 Rev. 1"
          },
          {
            "algorithm": "TLS v1.3 KDF (CVL)",
            "cavpCertName": "A6832, A6833",
            "properties": "HMAC Algorithm - SHA2-256, SHA2-384 KDF Running Modes - DHE, PSK, PSK-DHE",
            "reference": "SP 800-135 Rev. 1"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 5
      },
      "approved_services": {
        "entries": [
          {
            "description": "Add or delete operator account",
            "indicator": "System Logs",
            "inputs": "User data",
            "name": "Add/delete operator",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Crypto officer password: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Crypto Officer authenticates to the module over CLI/GUI",
            "indicator": "System Logs",
            "inputs": "Password",
            "name": "Authenticate to Module",
            "outputs": "Status",
            "rolesSspAccess": "User - Crypto officer password: W",
            "secFunImpl": "Operator authentication"
          },
          {
            "description": "Backup/restore configuration file",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Backup/restore configuration file",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Configuration encryption key: E - Configuration backup key: E - Crypto officer password: None",
            "secFunImpl": "Configuration backup"
          },
          {
            "description": "Connect to FortiAnalyzer for log transfer via OFTP over TLS",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Connect the module to remote FortiAnalyzer for transferring module\u0027s local logs to FortiAnalyzer using TLS",
            "outputs": "Status",
            "rolesSspAccess": "Admin - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS-PMS: G,E,Z",
            "secFunImpl": "KAS-TLS12 Random number CKG"
          },
          {
            "description": "Description",
            "indicator": "Indicator",
            "inputs": "Inputs",
            "name": "Name",
            "outputs": "Outputs",
            "rolesSspAccess": "SSP Access - TLS12-MS: G,E,Z - TLS-SAK: G - TLS-SEK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key: W,E,Z - DH-SS: G",
            "secFunImpl": "Security Functions"
          },
          {
            "description": "The module offers authentication over console port",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Connect to module remotely for web admin using SSH",
            "outputs": "Status",
            "rolesSspAccess": "- ECDH-SS: G - GCM-IV: G Admin - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - SSH-SS: G,E,Z - SSH-IK: G - SSH-EK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - SSH client public key: W,E,Z - SSH server public key: R - DH-SS: G - ECDH-SS: G",
            "secFunImpl": "Entropy KAS-SSH Random number CKG"
          },
          {
            "description": "The module offers authentication over TLS 1.2",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Connect to module remotely for web admin using TLS 1.2",
            "outputs": "Status",
            "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key:",
            "secFunImpl": "KAS-TLS12 Random number CKG"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS13-HS: G,E,Z - TLS13-HTS: G,E,Z - TLS13-MS: G,E,Z - TLS13-TK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key: W,E,Z - TLS Server Public Key: R - DH-SS: G - ECDH-SS: G - GCM-IV: G",
            "secFunImpl": ""
          },
          {
            "description": "The module offers authentication over TLS 1.3",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Connect to module remotely for web admin using TLS 1.3",
            "outputs": "Status",
            "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - TLS-PMS: G,E,Z - TLS12-MS: G,E,Z - TLS-SAK: G - TLS-SEK: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - TLS Client key:",
            "secFunImpl": "KAS-TLS13 Random number CKG"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "W,E,Z - TLS Server Public Key: R",
            "secFunImpl": ""
          },
          {
            "description": "Enable approved mode of operation",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Enable approved mode of operation (Console only)",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Configuration integrity key: E",
            "secFunImpl": "Configuration integrity"
          },
          {
            "description": "Configure the IPSec VPN policies",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Enable/disable alternating bypass mode",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Configuration integrity key: E",
            "secFunImpl": "Configuration integrity"
          },
          {
            "description": "Establish IPsec connection",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Establish IPsec connection",
            "outputs": "Status",
            "rolesSspAccess": "User - DH Private Key: G,E,Z - DH Public Key: G,R,E,Z - ECDH Private Key : G,E,Z - ECDH Public Key : G,R,E,Z - IKE-PSK: G,E - SKEYID: G,E,Z - SKEYID_e: G - SKEYID_a: G - DRBG Output: E - DH Peer Public Key: W,E,Z - ECDH Peer Public Key : W,E,Z - IKE RSA Peer Public key: W,E,Z - IKE ECDSA Peer Public Key: W,E,Z - SKEYSEED: G,E,Z - SK_a: G - SK_e: G - IKE RSA Public Key: R - IKE ECDSA Public Key: R",
            "secFunImpl": "KAS-IPSec Random number CKG"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "- DH-SS: G - ECDH-SS: G",
            "secFunImpl": ""
          },
          {
            "description": "Execute self tests manually",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Execute FIPS-CC on-demand self- tests (console only)",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Software update key: E",
            "secFunImpl": "SW Authentication"
          },
          {
            "description": "Zeroise the module",
            "indicator": "System Reboot",
            "inputs": "Command",
            "name": "Execute factory reset (disable approved mode, Console only)",
            "outputs": "-",
            "rolesSspAccess": "Admin - Crypto officer password: Z - Configuration integrity key: Z - Configuration encryption key: Z - Configuration backup key: Z - Software update key: Z - IPSec Manual Authentication key: Z - IPsec Manual Encryption key: Z - IKE RSA Private Key: Z - IKE RSA Public Key: Z - IKE ECDSA Private Key: Z - IKE ECDSA Public Key: Z - HA Password: Z - HA Encryption key: Z - TLS Server Private Key: Z - TLS Server Public Key: Z - SSH server private key: Z - SSH server public key: Z",
            "secFunImpl": "None"
          },
          {
            "description": "Execute software update",
            "indicator": "System Logs",
            "inputs": "SW image",
            "name": "Execute software update",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Software update key: E",
            "secFunImpl": "SW Authentication"
          },
          {
            "description": "Format log disk",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Format log disk (console only)",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Generate certificate signing request",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Generate CSR",
            "outputs": "CSR",
            "rolesSspAccess": "Admin - IKE RSA Private Key: G,E - IKE RSA Public Key: G,R,E - IKE ECDSA Private Key: G,E - IKE ECDSA Public Key: G,R,E - DRBG Output: E",
            "secFunImpl": "ECDSA CSR RSA CSR Random number CKG"
          },
          {
            "description": "Generate entropy for seeding the DRBG (Cannot be operator invoked)",
            "indicator": "Implicit",
            "inputs": "Command",
            "name": "Generate entropy",
            "outputs": "Entropy",
            "rolesSspAccess": "Unauthenticated - Entropy input: G",
            "secFunImpl": "Entropy"
          },
          {
            "description": "Generate random number for other module service (Cannot be operator invoked)",
            "indicator": "Implicit",
            "inputs": "Entropy",
            "name": "Generate random number",
            "outputs": "Random number",
            "rolesSspAccess": "Unauthenticated - Entropy input: E - DRBG Seed: G - DRBG V: G,E - DRBG Key: G,E - DRBG Output: G",
            "secFunImpl": "Random number"
          },
          {
            "description": "Modify operator preferences",
            "indicator": "System Logs",
            "inputs": "User data",
            "name": "Modify operator preferences",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Read log data",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Read log data",
            "outputs": "Log data",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Configure the module\u0027s high availability ports",
            "indicator": "System Logs",
            "inputs": "Configuration data",
            "name": "Read/set/delete/modify HA configuration",
            "outputs": "Status",
            "rolesSspAccess": "Admin - HA Password: W - HA Encryption key: W - Configuration integrity key: E",
            "secFunImpl": "Configuration integrity"
          },
          {
            "description": "Configure the module\u0027s VPN",
            "indicator": "System Logs",
            "inputs": "Configuration data",
            "name": "Read/set/delete/modify IPSec/SSL VPN configuration",
            "outputs": "Status",
            "rolesSspAccess": "Admin - IPSec Manual Authentication key:",
            "secFunImpl": "Configuration integrity"
          },
          {
            "description": "",
            "indicator": "",
            "inputs": "",
            "name": "",
            "outputs": "",
            "rolesSspAccess": "W - IPsec Manual Encryption key: W",
            "secFunImpl": ""
          },
          {
            "description": "Configure the module",
            "indicator": "System Logs",
            "inputs": "Configuration data",
            "name": "Read/set/delete/modify configuration",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "Configuration integrity"
          },
          {
            "description": "Sets or resets an operator password",
            "indicator": "System Logs",
            "inputs": "Command, password",
            "name": "Set/reset operator password",
            "outputs": "Status",
            "rolesSspAccess": "Admin - Crypto officer password: W",
            "secFunImpl": "None"
          },
          {
            "description": "Display the module\u0027s mode",
            "indicator": "System Logs",
            "inputs": "Command",
            "name": "Show approved mode enabled (console/cli only)",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Show system status",
            "indicator": "Status displayed via CLI/GUI",
            "inputs": "Command",
            "name": "Show system status",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Display the version of the module",
            "indicator": "Status displayed via CLI/GUI",
            "inputs": "Command",
            "name": "Show version",
            "outputs": "Status",
            "rolesSspAccess": "Admin",
            "secFunImpl": "None"
          },
          {
            "description": "Traffic over HTTP",
            "indicator": "Implicit",
            "inputs": "HTTP request",
            "name": "Traffic over HTTP",
            "outputs": "HTTP data",
            "rolesSspAccess": "User - TLS-SAK: E - TLS-SEK: E - TLS13-TK: E - GCM-IV: E",
            "secFunImpl": "Transfer data with GCM Transfer data with CBC"
          },
          {
            "description": "Traffic over IPsec",
            "indicator": "Implicit",
            "inputs": "Traffic data",
            "name": "Traffic over IPsec",
            "outputs": "Traffic data",
            "rolesSspAccess": "User - SKEYID_a: E - SKEYID_e: E - SK_a: E - SK_e: E - IPSec Manual Authentication key: E - IPsec Manual Encryption key: E - GCM-IV: E",
            "secFunImpl": "Transfer data with GCM Transfer data with CBC"
          },
          {
            "description": "Traffic over SSH",
            "indicator": "Implicit",
            "inputs": "SSH Command",
            "name": "Traffic over SSH",
            "outputs": "Status",
            "rolesSspAccess": "Admin - SSH-IK: E - SSH-EK: E - GCM-IV: E",
            "secFunImpl": "Transfer data with GCM Transfer data with CBC"
          },
          {
            "description": "Encryption of the pre-shared key used for reestablishing IPSec tunnels. (Cannot be operator invoked)",
            "indicator": "Implicit",
            "inputs": "-",
            "name": "Key encrypt",
            "outputs": "-",
            "rolesSspAccess": "User - Configuration encryption key: E - IKE-PSK: None",
            "secFunImpl": "Key encrypt"
          },
          {
            "description": "Decryption of static keys used for authentication in network protocols. Decryption of previously established IPSec pre shared key. (Cannot be operator invoked)",
            "indicator": "Implicit",
            "inputs": "-",
            "name": "Key decrypt",
            "outputs": "-",
            "rolesSspAccess": "Admin - Configuration encryption key: E - IPSec Manual Authentication key: None - IKE-PSK: None - IKE RSA Private Key: None - IKE RSA Public Key: None - IKE ECDSA Private Key: None - IKE ECDSA Public Key: None - HA Encryption key: None - HA Password: None - SSH server private key: None - SSH server public key: None",
            "secFunImpl": "Key decrypt"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 3
      },
      "authentication_methods": {
        "entries": [
          {
            "description": "Establishing a secure connection over IPSec",
            "mechanism": "KAS-IPSec",
            "name": "IPSec",
            "perMinute": "1 in 6.6x10^24",
            "strength": "1 in 5.2x10^33"
          },
          {
            "description": "Username and password",
            "mechanism": "Operator authentication",
            "name": "Password",
            "perMinute": "1 in 111262",
            "strength": "1 in 2.8x10^15"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 1
      },
      "cond_self_tests": {
        "entries": [
          {
            "algorithmOrTest": "AES",
            "condition": "On boot",
            "details": "Encrypt, decrypt",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "AES-ECB, 128 bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "AES-GCM",
            "condition": "On boot",
            "details": "Encrypt, decrypt",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "256-bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "DH key pairs",
            "condition": "On key generation",
            "details": "Sign, verify",
            "indicator": "Console message",
            "testMethod": "PCT",
            "testProps": "-",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "DRBG",
            "condition": "On boot",
            "details": "Instantiate, generate, reseed",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "AES-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "EC DH key pairs",
            "condition": "On key generation",
            "details": "Sign, verify, calculate public key",
            "indicator": "Console message",
            "testMethod": "PCT",
            "testProps": "-",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "ECC-SSC",
            "condition": "On boot",
            "details": "Compute",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "P-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA",
            "condition": "On boot",
            "details": "Sign, verify",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "P-256, P-384, P-521",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "ECDSA key pairs",
            "condition": "On key generation",
            "details": "Sign verify, calculate public key",
            "indicator": "Console message",
            "testMethod": "PCT",
            "testProps": "-",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "FFC-SSC",
            "condition": "On boot",
            "details": "Compute",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "MODP-2048",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "Software load",
            "condition": "On SW load",
            "details": "-",
            "indicator": "Console message",
            "testMethod": "SigVer",
            "testProps": "RSA 2048-bit with SHA-1 or SHA2- 256",
            "type": "SW/FW Load"
          },
          {
            "algorithmOrTest": "IKEv1 KDF",
            "condition": "On boot",
            "details": "Derive",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "IKEv2 KDF",
            "condition": "On boot",
            "details": "Derive",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA",
            "condition": "On boot",
            "details": "Sign, verify",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "2048-bit",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RSA key pairs",
            "condition": "On key generation",
            "details": "Sign, verify, encrypt, decrypt",
            "indicator": "Console message",
            "testMethod": "PCT",
            "testProps": "-",
            "type": "PCT"
          },
          {
            "algorithmOrTest": "SHA-1",
            "condition": "On boot",
            "details": "Hash",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "-",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA-2",
            "condition": "On boot",
            "details": "Hash",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA2-512",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SSH KDF",
            "condition": "On boot",
            "details": "Derive",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA-1",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLS 1.2 KDF",
            "condition": "On boot",
            "details": "Derive",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "TLS 1.3 KDF",
            "condition": "On boot",
            "details": "Derive",
            "indicator": "Console message",
            "testMethod": "KAT",
            "testProps": "SHA2-256",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "APT",
            "condition": "On generation",
            "details": "-",
            "indicator": "Module Halt",
            "testMethod": "FDT",
            "testProps": "Adaptive proportion test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "RCT",
            "condition": "On generation",
            "details": "-",
            "indicator": "Module Halt",
            "testMethod": "FDT",
            "testProps": "Repetition count test",
            "type": "CAST"
          },
          {
            "algorithmOrTest": "SHA3-256 (A4977)",
            "condition": "On boot",
            "details": "Hash",
            "indicator": "Console Message",
            "testMethod": "KAT",
            "testProps": "SHA3-256",
            "type": "CAST"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 2
      },
      "error_states": {
        "entries": [
          {
            "conditions": "If any self- test fails",
            "description": "All data output and cryptographic services are inhibited in the error state.",
            "indicator": "Self-tests failed Entering error mode... The system is going down NOW !! The system is halted",
            "name": "Error mode",
            "recoveryMethod": "Power cycling"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 4
      },
      "mechanisms_actions": {
        "entries": [],
        "found": false,
        "section": 7,
        "subsection": 1
      },
      "modes_of_operation": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 4
      },
      "non_approved_allowed_NSC": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_allowed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_not_allowed": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "non_approved_services": {
        "entries": [],
        "found": false,
        "section": 4,
        "subsection": 4
      },
      "ports_interfaces": {
        "entries": [
          {
            "data": "Network traffic, passwords, user data, new software images, configuration data, configuration file",
            "logicalInterface": "Data Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Network traffic, configuration file",
            "logicalInterface": "Data Output",
            "physicalPort": "N/A"
          },
          {
            "data": "Commands",
            "logicalInterface": "Control Input",
            "physicalPort": "N/A"
          },
          {
            "data": "Module status and configuration information",
            "logicalInterface": "Status Output",
            "physicalPort": "N/A"
          }
        ],
        "found": true,
        "section": 3,
        "subsection": 1
      },
      "roles": {
        "entries": [
          {
            "authMethodList": "Password",
            "name": "Admin",
            "operatorType": "CO",
            "type": "Identity"
          },
          {
            "authMethodList": "None",
            "name": "User",
            "operatorType": "User",
            "type": "Identity"
          }
        ],
        "found": true,
        "section": 4,
        "subsection": 2
      },
      "security_levels": {
        "entries": [
          {
            "level": "1",
            "section": "1",
            "title": "General"
          },
          {
            "level": "1",
            "section": "2",
            "title": "Cryptographic module specification"
          },
          {
            "level": "1",
            "section": "3",
            "title": "Cryptographic module interfaces"
          },
          {
            "level": "3",
            "section": "4",
            "title": "Roles, services, and authentication"
          },
          {
            "level": "1",
            "section": "5",
            "title": "Software/Firmware security"
          },
          {
            "level": "1",
            "section": "6",
            "title": "Operational environment"
          },
          {
            "level": "N/A",
            "section": "7",
            "title": "Physical security"
          },
          {
            "level": "N/A",
            "section": "8",
            "title": "Non-invasive security"
          },
          {
            "level": "1",
            "section": "9",
            "title": "Sensitive security parameter management"
          },
          {
            "level": "1",
            "section": "10",
            "title": "Self-tests"
          },
          {
            "level": "2",
            "section": "11",
            "title": "Life-cycle assurance"
          },
          {
            "level": "1",
            "section": "12",
            "title": "Mitigation of other attacks"
          },
          {
            "level": "1",
            "section": "",
            "title": "Overall Level"
          }
        ],
        "found": true,
        "section": 1,
        "subsection": 2
      },
      "self_tests": {
        "entries": [
          {
            "algorithmOrTest": "Configuration integrity",
            "details": "MAC verification",
            "indicator": "Console message",
            "testMethod": "MAC",
            "testProps": "HMAC-SHA2-256",
            "type": "Critical Function"
          },
          {
            "algorithmOrTest": "Software integrity",
            "details": "Signature verification",
            "indicator": "Console message",
            "testMethod": "SigVer",
            "testProps": "RSA 2048-bit, using SHA2-256",
            "type": "SW/FW Integrity"
          }
        ],
        "found": true,
        "section": 10,
        "subsection": 1
      },
      "ssp_io_methods": {
        "entries": [
          {
            "dest": "RAM",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public Key import",
            "sfiAlgo": "",
            "source": "External network device"
          },
          {
            "dest": "RAM",
            "distribution": "Manual",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Password",
            "sfiAlgo": "",
            "source": "External network device"
          },
          {
            "dest": "Software image",
            "distribution": "N/A",
            "entry": "N/A",
            "format": "Plaintext",
            "name": "Preloaded",
            "sfiAlgo": "",
            "source": "Manufacturer"
          },
          {
            "dest": "External network device",
            "distribution": "Automated",
            "entry": "Electronic",
            "format": "Plaintext",
            "name": "Public Key export",
            "sfiAlgo": "",
            "source": "RAM"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 2
      },
      "ssp_zeroization_methods": {
        "entries": [
          {
            "description": "Automatic zeroisation of SSPs that are no longer needed.",
            "method": "Auto",
            "operatorId": "N/A",
            "rationale": "Memory is overwritten with 0\u0027s"
          },
          {
            "description": "Power-cycle the host device",
            "method": "Reboot",
            "operatorId": "Unplugging the device",
            "rationale": "All RAM is zeroised by a power-cycle."
          },
          {
            "description": "Invoking the service to zeroise all SSPs in persistent storage. Causes an automatic reboot of the host device that zeroises all SSPs in volatile memory.",
            "method": "Service",
            "operatorId": "Issue the CLI command : execute erase-disk",
            "rationale": "The CLI command overwrites the storage location keys with 0\u0027s, making them irretrievable"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 3
      },
      "storage_areas": {
        "entries": [
          {
            "description": "Embedded in the software image",
            "name": "Software image",
            "persistance": "Static"
          },
          {
            "description": "SRDAM of host device",
            "name": "RAM",
            "persistance": "Dynamic"
          }
        ],
        "found": true,
        "section": 9,
        "subsection": 1
      },
      "tested_module_id_hw": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_hw_hy": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 2
      },
      "tested_module_id_sw_fw_hy": {
        "entries": [
          {
            "features": "",
            "integrityTest": "Signature verification",
            "packageFileName": "FGT_VM64-v7.2.8FIPS-CC-72-4-build9543- FORTINET.out",
            "swFwVersion": "FIPS-CC-72-4 (7.2)"
          },
          {
            "features": "",
            "integrityTest": "Signature verification",
            "packageFileName": "FGT_VM64-v7.4.4FIPS-CC-74-2-build8537- FORTINET.out",
            "swFwVersion": "FIPS-CC-74-2 (7.4)"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "tested_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "PacStar 451",
            "hypervisorHostOs": "VMware ESXi 6.7",
            "operatingSystem": "FortiOS",
            "paa_pai": "No",
            "processors": "Intel Xeon D- 1559",
            "version": "FIPS-CC-72-4 (7.2) FIPS-CC-74-2 (7.4)"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      },
      "vendor_affirmed_algos": {
        "entries": [],
        "found": false,
        "section": 2,
        "subsection": 5
      },
      "vendor_affirmed_op_env_sw_fw_hy": {
        "entries": [
          {
            "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)",
            "operatingSystem": "Amazon Linux 2027"
          },
          {
            "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)",
            "operatingSystem": "Amazon Linux 2023"
          },
          {
            "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)",
            "operatingSystem": "Amazon Linux 2"
          },
          {
            "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)",
            "operatingSystem": "Azure Linux 3.0"
          },
          {
            "hardwarePlatform": "x86 Architecture (Note: Specific processor/hardware is dependent on Instance/Machine Type selected for operating system)",
            "operatingSystem": "Azure Local v12"
          }
        ],
        "found": true,
        "section": 2,
        "subsection": 2
      }
    },
    "is_br1_format": true,
    "keywords": {
      "asymmetric_crypto": {
        "ECC": {
          "ECDH": {
            "ECDH": 29
          },
          "ECDSA": {
            "ECDSA": 36
          }
        },
        "FF": {
          "DH": {
            "DH": 35,
            "DHE": 1,
            "Diffie-Hellman": 5
          }
        }
      },
      "certification_process": {},
      "cipher_mode": {
        "CBC": {
          "CBC": 14
        },
        "GCM": {
          "GCM": 14
        }
      },
      "cplc_data": {},
      "crypto_engine": {},
      "crypto_library": {},
      "crypto_protocol": {
        "IKE": {
          "IKE": 35,
          "IKEv1": 9,
          "IKEv2": 11
        },
        "IPsec": {
          "IPsec": 17
        },
        "SSH": {
          "SSH": 35,
          "SSHv2": 1
        },
        "TLS": {
          "SSL": {
            "SSL": 2
          },
          "TLS": {
            "TLS": 23,
            "TLS 1.2": 18,
            "TLS 1.3": 18,
            "TLS v1.2": 2,
            "TLS v1.3": 2
          }
        },
        "VPN": {
          "VPN": 17
        }
      },
      "crypto_scheme": {
        "AEAD": {
          "AEAD": 1
        },
        "MAC": {
          "MAC": 13
        }
      },
      "device_model": {},
      "ecc_curve": {
        "NIST": {
          "P-256": 12,
          "P-384": 10,
          "P-521": 10
        }
      },
      "eval_facility": {},
      "fips_cert_id": {},
      "fips_certlike": {
        "Certlike": {
          "AES-128": 1,
          "AES-192": 1,
          "AES-256": 4,
          "DRBG 128": 1,
          "DRBG 256": 1,
          "DRBG 384": 1,
          "HMAC-SHA-1": 6,
          "SHA-1": 10,
          "SHA-2": 2,
          "SHA2- 256": 1,
          "SHA2-224": 5,
          "SHA2-256": 16,
          "SHA2-384": 7,
          "SHA2-512": 6,
          "SHA3-256": 6
        }
      },
      "fips_security_level": {
        "Level": {
          "Level 1": 3,
          "level 1": 1
        }
      },
      "hash_function": {
        "SHA": {
          "SHA1": {
            "SHA-1": 10
          },
          "SHA2": {
            "SHA-2": 2
          },
          "SHA3": {
            "SHA3-256": 6
          }
        }
      },
      "ic_data_group": {},
      "javacard_api_const": {},
      "javacard_packages": {},
      "javacard_version": {},
      "os_name": {},
      "pq_crypto": {},
      "randomness": {
        "PRNG": {
          "DRBG": 37
        },
        "RNG": {
          "RBG": 2
        }
      },
      "side_channel_analysis": {},
      "standard_id": {
        "FIPS": {
          "FIPS 140-3": 15,
          "FIPS 180-4": 1,
          "FIPS 186-5": 8,
          "FIPS 198-1": 5,
          "FIPS 202": 1,
          "FIPS140-3": 1,
          "FIPS186-5": 17
        },
        "NIST": {
          "SP 800-135": 5,
          "SP 800-186": 1,
          "SP 800-38A": 1,
          "SP 800-38D": 1,
          "SP 800-56A": 3,
          "SP 800-90A": 1
        },
        "RFC": {
          "RFC 4106": 1,
          "RFC 5282": 1,
          "RFC 5647": 1,
          "RFC 7296": 1,
          "RFC 8446": 1,
          "RFC7627": 1
        }
      },
      "symmetric_crypto": {
        "AES_competition": {
          "AES": {
            "AES": 4,
            "AES-128": 1,
            "AES-192": 1,
            "AES-256": 4
          },
          "CAST": {
            "CAST": 34
          }
        },
        "constructions": {
          "MAC": {
            "HMAC": 1
          }
        }
      },
      "tee_name": {
        "AMD": {
          "PSP": 15
        }
      },
      "tls_cipher_suite": {},
      "vendor": {
        "Microsoft": {
          "Microsoft": 1
        }
      },
      "vulnerability": {}
    },
    "module_algorithms": {
      "_type": "Set",
      "elements": [
        "TLS v1.2 KDF RFC7627A6833",
        "ECDSA SigVer (FIPS186-5)A6833",
        "RSA SigGen (FIPS186-5)A6833",
        "HMAC-SHA2-256A6833",
        "SHA-1A6833",
        "SHA3-256A4977",
        "Safe Primes Key GenerationA6833",
        "SHA2-256A6833",
        "HMAC-SHA2-384A6833",
        "KAS-FFC-SSC Sp800-56Ar3A6833",
        "RSA SigVer (FIPS186-5)A6833",
        "SHA2-512A6833",
        "KDF IKEv1A6833",
        "KAS-ECC-SSC Sp800-56Ar3A6833",
        "KDF IKEv2A6833",
        "SHA2-224A6833",
        "SHA2-384A6833",
        "RSA KeyGen (FIPS186-5)A6833",
        "HMAC-SHA-1A6833",
        "AES-CBCA6833",
        "ECDSA KeyGen (FIPS186-5)A6833",
        "TLS v1.3 KDFA6833",
        "HMAC-SHA2-512A6833",
        "KDF SSHA6833",
        "AES-GCMA6833",
        "ECDSA SigGen (FIPS186-5)A6833",
        "Counter DRBGA6831",
        "HMAC-SHA2-224A6833"
      ]
    },
    "policy_algorithms": {
      "_type": "Set",
      "elements": [
        "#A6832",
        "#A6833",
        "#A6831",
        "#A6800",
        "#A4977"
      ]
    },
    "policy_metadata": {
      "/CreationDate": "D:20261022160839-04\u002700\u0027",
      "/Creator": "Microsoft\u00ae Word for Microsoft 365",
      "/ModDate": "D:20261022160839-04\u002700\u0027",
      "/Producer": "Microsoft\u00ae Word for Microsoft 365",
      "pdf_file_size_bytes": 899701,
      "pdf_hyperlinks": {
        "_type": "Set",
        "elements": [
          "https://blog.fortinet.com/",
          "https://docs.fortinet.com/document/fortigate/7.2.8/administration-guide/954635",
          "https://docs.fortinet.com/",
          "https://www.fortinet.com/contact",
          "https://www.fortinet.com/doc/legal/EULA.pdf",
          "https://wwww.fortiguard.com/",
          "https://video.fortinet.com/",
          "https://csrc.nist.gov/projects/cryptographic-module-validation-program",
          "https://www.fortinet.com/support-and-training/training.html",
          "https://training.fortinet.com/",
          "https://www.fortinet.com/products",
          "https://docs.fortinet.com/document/fortigate/7.2.8/cli-reference/84566/fortios-cli-reference",
          "https://docs.fortinet.com/document/fortigate/7.2.8/fortios-log-message-reference/524940/introduction",
          "https://support.fortinet.com/",
          "https://fortiguard.com/"
        ]
      },
      "pdf_is_encrypted": false,
      "pdf_number_of_pages": 54
    }
  },
  "state": {
    "_type": "sec_certs.sample.fips.InternalState",
    "module": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": null,
      "source_hash": null,
      "txt_hash": null
    },
    "policy": {
      "_type": "sec_certs.sample.document_state.DocumentState",
      "convert_ok": true,
      "download_ok": true,
      "extract_ok": true,
      "json_hash": "f75065c812c906e5d2421a8b3e7cc208e5cdb91aa4fee965eb7193a03dbffc51",
      "source_hash": "c72708f22919ae34095d85c977c46263280b24391060fd7a25b57f07b0fe7657",
      "txt_hash": "29270200d9e1f6531cedcbb200bed955e52441acd9214ed8cf1452434ad1ce08"
    }
  },
  "web_data": {
    "_type": "sec_certs.sample.fips.FIPSCertificate.WebData",
    "caveat": "When installed, initialized and configured as specified in Sections 2 and 11 of the Security Policy",
    "certificate_pdf_url": null,
    "date_sunset": "2031-10-28",
    "description": "FortiGate-VM 7.2/7.4 is a software module designed to execute on a General Purpose Computer (GPC) hardware platform running the VMware hypervisor. The module provides integrated firewall, VPN, antivirus, antispam, intrusion prevention, content filtering, traffic shaping, and HA capabilities.",
    "embodiment": "MultiChipStand",
    "exceptions": [
      "Roles, services, and authentication: Level 3",
      "Physical security: N/A",
      "Non-invasive security: N/A",
      "Life-cycle assurance: Level 2"
    ],
    "fw_versions": null,
    "historical_reason": null,
    "hw_versions": null,
    "level": 1,
    "mentioned_certs": {},
    "module_name": "FortiGate-VM 7.2/7.4",
    "module_type": "Software",
    "revoked_link": null,
    "revoked_reason": null,
    "standard": "FIPS 140-3",
    "status": "active",
    "sw_versions": null,
    "tested_conf": null,
    "validation_history": [
      {
        "_type": "sec_certs.sample.fips.FIPSCertificate.ValidationHistoryEntry",
        "date": "2026-10-29",
        "lab": "Lightship Security, Inc.",
        "validation_type": "Initial"
      }
    ],
    "vendor": "Fortinet, Inc.",
    "vendor_url": "http://www.fortinet.com"
  }
}