Kaseya FIPS Edge Service

The Kaseya FIPS Edge Service is a new component introduced in VSA 9.5.27 that handles Transport Layer Security (TLS) termination and Federal Information Processing Standard (FIPS) 140-3 compliant cryptographic operations. It replaces the TLS termination role previously performed by the VSA Edge Service, helping you meet modern security and compliance requirements.

Key capabilities

  • FIPS 140-3 cryptographic operations: Performs all TLS and cryptographic operations using OpenSSL with a SafeLogic FIPS 140-3 compliant module.
  • TLS termination: Handles all inbound TLS connections in place of the existing VSA Edge Service.
  • IPv4 and IPv6 support: Accepts connections over both IPv4 and IPv6 networks.
  • Automated certificate validation and repackaging: Detects non-FIPS-compliant certificate packages during installation and offers in-place remediation using FIPS-approved algorithms.
  • Dedicated logging: Provides a separate logging framework to simplify FIPS compliance validation and troubleshooting.
  • Enhanced agent security: Extends FIPS-enabled cryptographic operations to agent communications, with automatic cipher and certificate migration during upgrade.

How it works

The Kaseya FIPS Edge Service sits in front of the existing VSA Edge Service and intercepts all TLS traffic. When a connection arrives, the FIPS Edge Service performs TLS termination using its FIPS 140-3 validated OpenSSL module, then forwards the decrypted traffic to the VSA Edge Service for standard processing. Configuration settings previously managed by the VSA Edge Service — including listening port management, TLS configuration, FIPS configuration settings, and IP filtering — are now owned by the FIPS Edge Service and stored in a dedicated configuration file.

NOTE  After upgrading to VSA 9.5.27, any SSL certificate changes require a restart of the FIPS Edge Service rather than the traditional Edge Service.

To review which operating systems are supported and tested with FIPS 140-3, refer to Agent Minimum Requirements.

NOTE  Windows Server 2025 support is pending FIPS certification verification. Consult Kaseya support for current status before deploying on Windows Server 2025.

This procedure walks you through the VSA 9.5.27 upgrade, including certificate validation, optional certificate repackaging, and post-upgrade verification steps required to enable FIPS 140-3 compliant communications.

Before you begin

Confirm the following before starting the upgrade:

  • The VSA server runs one of the supported operating systems: Windows Server 2016, Windows Server 2019, or Windows Server 2022.
  • All managed endpoints run a supported operating system. Refer to Supported operating systems.
  • You have reviewed all third-party integrations, custom applications, browsers, and API clients that connect to VSA, particularly those running on older operating systems or using legacy cryptographic libraries.
  • You have validated agent connectivity in a test environment before upgrading production systems.
  • You are using the current VSA 9.5.27 installation package. Installer packages from previous releases may not function correctly in a 9.5.27 environment.

    NOTE  The installer will be updated to VSA 9.5.27 after the General Availability rollout date. Refer to the VSA 9.5.27 release notes.

  • You have backed up your current Edge Service configuration.

    IMPORTANT  Do not restore pre-9.5.27 Edge configuration files after upgrading; doing so may cause configuration conflicts, incorrect listening ports, and service startup failures.

Procedure

  1. Launch the VSA 9.5.27 installer.
  2. When the installer reaches the certificate validation step, review the results displayed for your existing SSL/TLS certificate package.
    • If the certificate package uses FIPS-approved PKCS#12 algorithms, proceed to step 5.
    • If the installer detects a non-FIPS-compliant certificate package, continue to step 3.
  3. When prompted about the non-compliant certificate package, select the option to repackage the certificate using FIPS-compliant algorithms. The installer automatically backs up the original certificate before making any changes.
  4. Wait for the installer to complete repackaging and validate the newly created certificate package.
  5. Complete the remaining installer steps to finish the upgrade.
  6. After the upgrade completes, open Services on the VSA server and confirm that the Kaseya FIPS Edge Service is running.
  7. Verify that agents successfully check in to the VSA console.
  8. Review the FIPS Edge Service logs and confirm entries for successful FIPS module initialization, certificate loading, and TLS connection processing.
  9. Review agent logs and confirm entries indicating successful initialization of FIPS-enabled cryptographic operations.
  10. Review endpoint component logs and confirm entries for cryptographic initialization, OpenSSL integration, and certificate processing.

NOTE  Agent installation packages are larger in VSA 9.5.27 due to the inclusion of additional OpenSSL and migration components. This is expected behavior.

Result

The Kaseya FIPS Edge Service is running and handling all TLS termination. Agents are communicating using FIPS-enabled cryptographic operations, and your environment is ready for FIPS 140-3 compliant operation.

IMPORTANT  Upgrading to VSA 9.5.27 makes your environment FIPS 140-3 ready. However, to achieve full FIPS 140-3 compliance, the TLS 1.2 Extended Master Secret (EMS) setting must also be enabled in the FIPS Edge configuration file. Refer to Enabling Extended Master Secret on TLS 1.2.

Post-upgrade verification checklist

After upgrading to VSA 9.5.27, verify each of the following to confirm the FIPS Edge Service is operating correctly.

Check Expected result
Kaseya FIPS Edge Service status Service is running on the VSA server.
Agent check-in All agents successfully check in to the VSA console.
Endpoint service initialization Endpoint services initialize without errors.
FIPS Edge logs Logs contain entries confirming successful FIPS module initialization.
SSL certificate loading Logs confirm SSL certificates load correctly.
Agent logs Logs contain entries confirming successful FIPS-mode initialization at the agent level.

Extended Master Secret (EMS) on TLS 1.2 is disabled by default after upgrading to VSA 9.5.27.

IMPORTANT  Enable EMS only after all agents have been upgraded to ensure uninterrupted connectivity.

Before you begin

  • All agents must be upgraded to the VSA 9.5.27 agent before you enable EMS. Enabling EMS before completing agent upgrades may cause connectivity failures for older agents that do not meet the updated cryptographic requirements.
  • Validate all third-party integrations, custom applications, browsers, and API clients before enabling EMS.

Procedure

  1. Confirm all agents have been upgraded and are successfully checking in to the VSA console.
  2. Navigate to the FIPS Edge Service configuration settings in your VSA environment.
  3. Select the option to enable EMS for TLS 1.2.
  4. Restart the Kaseya FIPS Edge Service to apply the change.
  5. Verify that all agents continue to check in successfully after the restart.

Result

EMS is enabled on TLS 1.2, and your environment operates with full FIPS-compliant TLS 1.2 communications.

Windows Certificate Store import behavior

Certificates repackaged using FIPS-compliant algorithms may fail to import into certain Windows certificate stores. In these cases, Windows may report an incorrect password error even when the password is valid. If you encounter this issue, contact Kaseya support for guidance.

Legacy agent connectivity after EMS is enabled

Agents that have not been upgraded to the VSA 9.5.27 agent may be unable to communicate with the VSA after you enable EMS. Upgrade all agents before enabling EMS to prevent connectivity interruptions.

Pre-upgrade Edge configuration and certificate files

Restoring a pre-9.5.27 Edge Service configuration file or certificate without following upgrade guidance may result in failed communications, incorrect listening ports, and service conflicts. Always use current configuration files after upgrading.

The following table describes the configuration areas and log fields associated with the Kaseya FIPS Edge Service.

Field Description
Listening port management Defines the ports on which the FIPS Edge Service accepts inbound TLS connections. Migrated from the VSA Edge Service configuration in VSA 9.5.27.
TLS configuration Controls TLS protocol versions and cipher suite settings used by the FIPS Edge Service. Migrated from the VSA Edge Service configuration in VSA 9.5.27.
FIPS configuration settings Enables and configures FIPS 140-3 mode for the FIPS Edge Service, including OpenSSL module initialization parameters. Migrated from the VSA Edge Service configuration in VSA 9.5.27.
IP filtering configuration Specifies allowlist and blocklist rules that control which IP addresses can connect to the FIPS Edge Service, where applicable. Migrated from the VSA Edge Service configuration in VSA 9.5.27.
Extended Master Secret (EMS) Controls whether EMS is enabled for TLS 1.2 connections. Disabled by default after upgrading to VSA 9.5.27. Enable only after all agents are upgraded to the 9.5.27 agent.
OpenSSL version Displayed in FIPS Edge logs. Confirms the OpenSSL version in use for cryptographic operations.
FIPS module initialization Logged by the FIPS Edge Service on startup. Confirms that the SafeLogic FIPS 140-3 cryptographic module initialized successfully.
Certificate loading operations Logged by the FIPS Edge Service. Confirms that SSL certificates were loaded correctly at startup.
TLS connection processing Logged by the FIPS Edge Service during operation. Records details of inbound TLS connection handling.
FIPS mode status Logged by the FIPS Edge Service. Indicates whether the service is operating in FIPS mode.