To use FIPS mode, certificates can be stored in either a SAF key ring, PKCS #11 token, or a FIPS mode key database. All certificates in a certificate chain to be used by a FIPS enabled application must use algorithms and key sizes as specified in Table 1.