RSA Product Set: SecurID
RSA Product/Service Type: RSA Authentication Manager
RSA Version/Condition: RSA Authentication Manager 8.9 Patch 2 and later
Environment: Windows Server 2016 and Windows Server 2019 with the RSA MFA Agent

After upgrading RSA Authentication Manager to version 8.9 Patch 2 or later, one or more Windows servers protected by the RSA MFA Agent may stop authenticating users.

Observable symptoms:

• The RSA authentication prompt does not appear on the affected server, or authentication attempts fail silently.
• Other MFA-protected servers in the same environment continue to operate normally.
• Network packet captures on the affected server show:
  • The TCP three-way handshake completes successfully.
  • The server sends a TLS ClientHello message.
  • The TLS handshake does not complete — Authentication Manager terminates the connection immediately after TLS negotiation begins.

Note: Not all MFA-protected servers may be affected. The issue depends on the cipher suites available on each individual server.

The affected Windows server does not offer a cipher suite compatible with the TLS requirements introduced in RSA Authentication Manager 8.9 Patch 2 or later.

This commonly occurs on older Windows Server versions (such as Windows Server 2016) where only legacy cipher suites are enabled — for example, suites using RSA key exchange, CBC encryption, or older hashing algorithms. Authentication Manager 8.9 Patch 2 and later require cipher suites that use ECDHE key exchange, AES-GCM encryption, and SHA256 or stronger hashing, and will terminate connections that do not meet these requirements.

Step 1: Identify at least one compatible cipher suite to enable on the affected server. The following cipher suites are supported by RSA Authentication Manager 8.9 Patch 2 and later:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Step 2: Configure the affected server to enable at least one of the cipher suites listed above. The change may be applied through the organization's approved configuration method, such as:

• Domain Group Policy
• Local Group Policy
• An approved Windows security-management tool
• IIS Crypto (if permitted by the organization)

NOTE: IIS Crypto is a third-party utility and is not supplied or supported by RSA. Obtain approval from your Windows or security administration team before installing or using it.

Step 3: Verify that the compatible cipher suite is enabled using one of the following options:

Option A: IIS Crypto (Recommended)

1. Open IIS Crypto on the affected server.
2. Review the TLS protocols and cipher suites enabled.
3. Confirm that at least one of the supported cipher suites is present.

Option B: Group Policy

1. Open the Group Policy Editor and navigate to: Computer Configuration > Policies > Administrative Templates > Network > SSL Configuration Settings > SSL Cipher Suite Order
2. Confirm that at least one of the supported cipher suites is listed.

Option C: PowerShell

1. Open an elevated PowerShell window.
2. Run the following command:
   

   Get-TlsCipherSuite | Where-Object Name -in "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" | Select-Object -ExpandProperty Name
   

3. If one or both cipher suite names are returned, they are available on the server. If no output is returned, neither cipher suite is enabled.

Step 4: Restart the affected Windows server if required by the configuration method used.

Step 5: Verification — Confirm the fix by performing the following:

1. Attempt authentication from the affected MFA-protected server.
2. Confirm that the RSA authentication prompt appears.
3. Confirm that the authentication request reaches Authentication Manager.
4. Confirm that authentication completes successfully.

Expected result: TLS negotiation completes successfully, MFA Agent communication with Authentication Manager resumes, and users can authenticate normally.

• Third-Party Tools: IIS Crypto is a commonly used utility for managing TLS and cipher suite configurations on Windows servers. It is not supplied or supported by RSA. Customers should consult their Windows or security administration team before use.
• Scope of Impact: Not all MFA-protected servers may be affected. The issue depends on the cipher suites configured on each individual Windows server. Servers that already support ECDHE-based cipher suites will not experience this issue.
• Restart Requirement: Some cipher suite configuration methods (such as Group Policy or registry changes) may require a server restart before the changes take effect.