MFA stopped working after TLS 1.2 Cloud enforcement in SecurId Access
Originally Published: 2023-04-05
Last Modified: 2023-10-06
Article Number
Applies To
RSA Product/Service Type: MFA Agent for windows
RSA Version/Condition: 2.0.x and 2.1.x
Issue
Cause
- From OfflineAuthenticaton Logs:
Caught Api exception: IO.Swagger.OfflineAuthenticationClient.ApiException: Error calling RequestOfflineMetadata: The request was aborted: Could not create SSL/TLS secure channel. at IO.Swagger.OfflineAuthenticationApi.OfflineMetadataApi.RequestOfflineMetadataWithHttpInfo(OfflineMetadataRequest offlineMetadataRequest) at RSA.Authentication.Offline.Services.DayFileSvc.GetOfflineMetaData(String offlineUrl, String accessKey, String clientId, String accessPolicyId, String userName, String domain, String attemptId) error code 0
The TLS failure implies that either
a) The CAS Root CA cert is not trusted by this system, or
b) The Agent cannot negotiate a mutually acceptable cipher algorithm with CAS.
b) The Agent cannot negotiate a mutually acceptable cipher algorithm with CAS.
- Take a packet capture which will show the SSL Handshake failure.
Resolution
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (0x9f)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (0x9e)
Note: Use a tool (e.g. IIS crypto) to make sure that the following ciphers are near the top if the above ciphers does not exist there is a high possibility that the windows machines are missing a critical Roll-up update (KB2919355 - April 2014). This roll-up included the additional ciphers needed for the MFA agent to function correctly with CAS
Link to download IIS Crypto: https://www.nartac.com/Products/IISCrypto/Download
More info for the KB2919355: https://support.microsoft.com/en-us/topic/update-adds-new-tls-cipher-suites-and-changes-cipher-suite-priorities-in-windows-8-1-and-windows-server-2012-r2-8e395e43-c8ef-27d8-b60c-0fc57d526d94
Related Articles
Remote AFX Server does not start, there is a SocketException in esb.AFX_INIT.log, and OpenSSL cannot complete an SSL Hands… Number of Views PAM Agent is failing to connect to RSA Servers (Curl error code: 35) Number of Views Failing to access Identity Router IDR Web resource after IDR v2.17 update Number of Views RSA Authentication Manager Prime Help Desk Admin (HDAP) and/or Self-Service Portal (SSP) not accessible after upgrade to R… Number of Views Upgrade to RSA Authentication Manager 8.4.0 breaks LDAPS and other TLS/SSL connections Number of Views
Trending Articles
RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide User Application Portal The RSA Identity Governance & Lifecycle AD Collector and AD ADC authentication source fail to establish a TLS 1.2 SSL conn… RSA Authentication Manager 8.1 Quick Setup Fails with "Failed to Attach Replica Instance" How to Replace the Web Server Certificate for the RSA Identity Governance & Lifecycle Web Console
Don't see what you're looking for?
