FIM 3.1.2 - CryptoJ jar causing signature verification errors with md2 signature algorithm
Originally Published: 2008-05-22
Article Number
Applies To
IBM WebSphere 6.0.2
Crypto J jar version 3.5.2 - jsafeJCEFIPS.jar in security.providers
Certificate caontains an md2RSA hash
Issue
signature verification error in system log
2008-05-05 20:52:06,042, (SSOHelper.java:608), uhaps004, , , , SSO top-level profile exception: , com.rsa.fim.exception.ProfileException: The response signature cannot be verified: The message is signed, but the signature cannot be verified
Cause
Resolution
Apply one of the following three solutions:
- Move the jsafeJCEFIPS.jar to the bottom of the security providers list or at least below the IBM versions of Jsafe com.ibm.crypto.provider.IBMJCE or com.ibm.crypto.fips.provider.IBMJCEFIPS.
- Replace the certs with signature algorithms other than MD2, such as SHA1
- Obtain hotfix FIM 3.1.2.5 which uses version 4.0 of the jsafeJCEFIPS. jar and add "com.rsa.cryptoj.jce.fips140initialmode=NON_FIPS140_MODE" to the bottom of the java.security file. This will turn off forced FIPS compliance ( added since CRYPTOJ 3.6 version) which would not of allowed md2 certs to be used.
Related Articles
Unable to Authenticate to vCenter – "Signature Certificate Verification Failed: Signature Does Not Match" Number of Views When signing a SHA256 CA off a SHA1 Root CA it does not have a SHA256 signature algorithm in RCM Number of Views Weak Certificate Signature Hashing Algorithm on TCP ports 5550 & 5580, CVE-2004-2761, CVE-2005-4900 Number of Views RSA Identity Governance and Lifecycle error "Signature on SAML authn failed to verify" when processing SAML assertion from… Number of Views intermittant FIM "error failed to validate signature value" Number of Views
Trending Articles
RSA Authentication Manager 8.7 SP2 Setup and Configuration Guide RSA MFA Agent 2.5 for Microsoft Windows Installation and Administration Guide How to Upgrade Internal SHA-1 Certificates to SHA-256 in Authentication Manager Using rsautil RSA Release Notes for RSA Authentication Manager 8.8 RSA Authentication Manager 8.9 Setup and Configuration Guide
Don't see what you're looking for?
