you must provide `secrets.cipher` for FIPS compliance

Error message

you must provide `secrets.cipher` for FIPS compliance

What it means

In FIPS 140 mode, the config validator requires an explicit `secrets.cipher` value, used for encrypting sensitive data at rest. FIPS mode forbids silently generating/falling back to non-FIPS-derived cipher secrets, so an empty `secrets.cipher` fails validation.

Solutions

Set `secrets.cipher` in config (typically a 32-byte/long random string) or its env equivalent
Generate with a FIPS-approved random source and store in your secret manager
Also set secrets.pagination, secrets.cookie, secrets.default which are checked in the same block
Confirm FIPS mode is intentional; if not, disable fips140 to restore default secret generation

Example fix

// before
secrets:
  pagination: ["..."]
// after
secrets:
  pagination: ["..."]
  cipher: ["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"]

Defensive patterns

Strategy: validation

Validate before calling

if fipsEnabled && len(cfg.Secrets.Cipher) == 0 {
  return errors.New("secrets.cipher is required in FIPS mode")
}

Prevention

Keep pagination/cipher/cookie/default secrets defined together as one versioned secret bundle
Use a FIPS-approved RNG when generating secrets
Lint configs for required keys when fips140 is enabled

When it happens

Trigger: Server startup config validation with fips140.Enabled() true and no values under the `secrets.cipher` config key (env or file).

Common situations: Deploying to FIPS-required environments (government, regulated industries) without updating config; upgrading the Ory stack to a version that enforces FIPS secret requirements.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of ory/kratos@b86338da04 (2026-09-07). Data as JSON: /api/errors/7d3cfd09713e88ef. Report an issue: GitHub.

Appendix: source

Thrown at driver/config/config.go:438

	p, err := configx.New(ctx, embedx.ConfigSchema, opts...)
	if err != nil {
		return nil, err
	}

	l.UseConfig(p)

	c = NewCustom(l, p, stdOutOrErr, ctxer)

	if !p.SkipValidation() {
		if err := c.validateIdentitySchemas(ctx); err != nil {
			return nil, err
		}
		if fips140.Enabled() {
			if len(p.Strings(ViperKeySecretsPagination)) == 0 {
				return nil, errors.New("you must provide `secrets.pagination` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCipher)) == 0 {
				return nil, errors.New("you must provide `secrets.cipher` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsCookie)) == 0 {
				return nil, errors.New("you must provide `secrets.cookie` for FIPS compliance")
			}
			if len(p.Strings(ViperKeySecretsDefault)) == 0 {
				return nil, errors.New("you must provide `secrets.default` for FIPS compliance")
			}
		}
	}

	return c, nil
}

func NewCustom(l *logrusx.Logger, p *configx.Provider, stdOutOrErr io.Writer, ctxt contextx.Contextualizer) *Config {
	l.UseConfig(p)
	return &Config{l: l, p: p, c: ctxt, stdOutOrErr: stdOutOrErr}
}

View on GitHub (pinned to b86338da04)