Altinity Stable® FIPS-Compatible Builds for ClickHouse® Release Notes

These are the release notes for Altinity Stable® FIPS-Compatible builds for ClickHouse®.

Release history

Here are the currently supported releases of Altinity Stable FIPS-Compatible builds:

Version Release date Details Docker images
25.3.8.30001-FIPS 2026-04-11 CI report | Release page AMD64 and Aarch64
24.3.5.48-FIPS 2024-09-04 CI report | Release page AMD64
23.3.19-FIPS 2024-03-21 CI report | Release page AMD64
23.3.8.23-FIPS 2023-09-25 CI report AMD64
22.8.15.25-FIPS 2023-05-31 CI report AMD64

v25.3.8.30001-FIPS

Released 2026-04-11

Build report - 25.3.8.30001.altinityfips | Release page

This release delivers a build of ClickHouse based on Altinity Stable release v25.3.8.10042, with changes to cryptography, packaging, and feature availability to ensure compliance with the FIPS 140-3 standard. Key changes include:

  • Replacing the cryptographic foundation with a validated module
  • Enforcing strict security defaults
  • Removing non-compliant features
  • Providing operational transparency and validation tooling

⚠️ Due to encryption format changes and removed features, careful migration planning is required when upgrading from non-FIPS builds.

Changes compared to 25.3.8.10042.altinitystable

FIPS Compliance

AWS-LC FIPS 2.0.0 Integration

  • ClickHouse is now built against AWS-LC FIPS 2.0.0, replacing OpenSSL library.
  • Full FIPS validation flow enforced at build time, including Known Answer Tests (KAT) and integrity verification.
  • FIPS mode is enabled and verified at runtime.

Startup Visibility

  • Server logs now explicitly confirm FIPS status:
    • FIPS mode enabled
    • KAT test result
    • Integrity check result

Build Introspection

  • system.build_options now exposes:
    • FIPS_CLICKHOUSE=1
    • OPENSSL_VERSION=AWS-LC-FIPS-2.0.0
  • Enables programmatic validation of compliance state.

⚠️ Breaking Changes

Encryption Codecs (Incompatible Change)

  • AES-GCM-SIV codecs removed (not FIPS-approved).
  • Replaced with:
    • AES_128_GCM
    • AES_256_GCM
  • On-disk format is incompatible:
    • Data encrypted with Codec(AES_128_GCM_SIV) / Codec(AES_256_GCM_SIV) cannot be read by this FIPS release.
    • Symmetrically, data encrypted by this release with Codec(AES_128_GCM) / Codec(AES_256_GCM) cannot be read by other builds.

Migration required:

  1. Decrypt data using the original build used for encryption.
  2. Re-encrypt using new FIPS codec.

🚫 Disabled Features

Due to FIPS constraints and removal of Rust dependencies:

  • Delta Lake engine (DeltaLake, deltaLake())
  • PRQL query dialect
  • Interactive fuzzy history search (Ctrl+R in client)

These features rely on Rust components that are not currently FIPS-compatible.

TLS & Security Enhancements

TLS 1.3 Hardening

  • Default cipher suites restricted to FIPS-approved:
    • TLS_AES_256_GCM_SHA384
    • TLS_AES_128_GCM_SHA256
  • ChaCha20-Poly1305 removed from defaults.

Full TLS Configuration Enforcement

  • All components (including Keeper) now enforce:
    • cipherSuites
    • cipherList
    • dhParamsFile
    • ecdhCurve

Protocol Control Fix

  • disableProtocols tlsv1_3 now works correctly (previously ignored).

Authentication & Security Changes

Kerberos (Breaking Behavior Change)

  • Only AES-based encryption types supported:
    • aes256-cts-hmac-sha1-96
    • aes128-cts-hmac-sha1-96
  • DES / 3DES configurations are rejected.

PostgreSQL Authentication

  • Hashing functions routed through AWS-LC to ensure FIPS compliance.

Storage & Integration Changes

Enabled Integrations

FIPS builds include full support for:

  • S3
  • Azure Blob Storage (via Altinity fork)
  • gRPC
  • Parquet
  • Kafka, NATS, MySQL, MongoDB
  • Cassandra, AMQP

Forked Dependencies

To ensure compatibility with AWS-LC:

Packaging & Distribution

Crash Reporting Disabled by Default

  • No Sentry endpoint configured
  • Even if enabled, no data is sent externally

FIPS Validation Tooling

New built-in subcommands for compliance validation:

  • clickhouse ssl-shim — TLS conformance testing
  • clickhouse ssl-handshaker — test harness peer
  • clickhouse acvp-server — cryptographic validation (ACVP)

These tools support certification and auditing workflows.

Platform Support

  • x86_64 (existing)
  • ARM64 / AArch64 (newly supported)

Operational Improvements

  • Improved TLS error handling compatibility with AWS-LC
  • Fixed MongoDB TLS connectivity issues
  • Cleaner and more consistent TLS configuration behavior across services

Full changelog - v25.3.8.10042.altinitystable...v25.3.8.30001.altinityfips

Let’s Install!

Linux packages for both AMD64 and Aarch64 can be found at builds.altinity.cloud/#altinityfips as either .deb, .rpm, or .tgz. Linux packages for upstream builds are at packages.clickhouse.com.

Altinity Stable FIPS-Compatible Build images are available at DockerHub as altinity/clickhouse-server:25.3.8.30001.altinityfips.

For more information on installing ClickHouse from either the Altinity Builds or the upstream builds, see the ClickHouse Altinity Stable Builds Install Guide.

Please contact us at info@altinity.com if you experience any issues with the upgrade.

v24.3.5.48-FIPS

Released 2024-09-04

Build report - 24.3.5.48 FIPS | Release page

This is a FIPS-compatible release of version 24.3.5.

Changes compared to 24.3.5.47.altinitystable

Improvement

  • Building BoringSSL ver fips-20210429 (853ca1ea1168dff08011e5d42d94609cc0ca2e27) according to FIPS-140-2 Security Policy 4407, based on build scripts from Golang version go1.22.5
  • Added FIPS_CLICKHOUSE to system.build_options
  • Modified ClickHouse keeper to use full range of openSSL options (same as ClickHouse does) for Raft connections using ubuntu:22.04 as a base for clickhouse-server docker images instead of ubuntu:20.04

Build/Testing/Packaging Improvement

  • CI/CD for FIPS mode
  • Other fixes for CI/CD

Full Changelog: v24.3.5.47.altinitystable...v24.3.5.48.altinityfips

Let’s Install!

Linux packages can be found at packages.clickhouse.com for upstream builds, and at builds.altinity.cloud/#altinityfips for Altinity Stable builds. The Altinity Stable build for this release is available for AMD64 as either .deb, .rpm, or .tgz.

Docker images for the upstream version should be referenced as clickhouse/clickhouse-server:24.3.5.46.

Altinity Stable FIPS-Compatible Build images are available for AMD64 at DockerHub as altinity/clickhouse-server:24.3.5.48.altinityfips.

For more information on installing ClickHouse from either the Altinity Builds or the upstream builds, see the ClickHouse Altinity Stable Builds Install Guide.

Please contact us at info@altinity.com if you experience any issues with the upgrade.

v23.3.19-FIPS

Released 2024-03-21

Build report - 23.3.19.34 FIPS | Release page

This is a FIPS-compatible release of version 23.3.19.

Changes compared to 23.3.19.33.altinitystable

Improvement

  • Building BoringSSL (ae223d6138807a13006342edfeef32e813246b39) in FIPS mode, based on procedures of Go 1.19 (#235 by @Enmk)
  • FIPS mode for Keeper (#255, #274 by @Enmk)

Build/Testing/Packaging Improvement

  • CI/CD for FIPS mode (#218 by @zvonand)
  • other fixes for CI/CD

Altinity Stable FIPS-Compatible Build images are available for AMD64 at DockerHub as altinity/clickhouse-server:23.3.19.34.altinityfips.

Full Changelog: v23.3.19.33.altinitystable...v23.3.19.34.altinityfips

v23.3.8.23-FIPS

Released 2023-09-25

Build report - 23.3.8.23 FIPS

FIPS-Compatible Altinity Stable Build for ClickHouse 23.3.8 is based on Altinity Stable for ClickHouse 23.3.8

Changes Compared to Altinity Stable 23.3.8

FIPS-related changes atop of v23.3.8.22.altinitystable

  • Using BoringSSL built in FIPS mode
  • Added FIPS_CLICKHOUSE to system.build_options
  • Modified ClickHouse Keeper to use the full range of openSSL options, just as ClickHouse does for HTTP, TCP, and other types of server connections
  • A bit of extra logging for FIPS mode at startup.

Altinity Stable FIPS-Compatible Build images are available for AMD64 at DockerHub as altinity/clickhouse-server:23.3.8.23.altinityfips.

v22.8.15.25-FIPS

Released 2023-05-31

Build report - 2.8.15.25 FIPS

FIPS-Compatible Altinity Stable Build for ClickHouse 22.8.15 is based on Altinity Stable for ClickHouse 22.8.15

Changes Compared to Altinity Stable 22.8.15

Altinity Stable FIPS-Compatible Build images are available for AMD64 at DockerHub as altinity/clickhouse-server:22.8.15.25.altinityfips.