After updating IBM WebSphere to the latest patch containing IBM JDK 1.8.0_281 (or later), RSA Identity Governance & Lifecycle fails to start and logs the following message in system.out and aveksaServer.log file:
[9/23/21 21:45:52:197 CEST] 0000007d SystemOut O ERROR (server.startup : 1) [CheckDatabase] Error reading Aveksa_System.cfg
java.lang.IllegalStateException: An issue with handling encryption was encountered
This issue occurs on the first attempt to load the third-party crypto libraries in the CheckDatabase step.
This issue is caused by changes to the IBM JRE in JDK 1.8.0_281 (and later) which removed expired certificates from the "trusted provider verification list" used to sign third-party JCE libraries in the RSA Identity Governance & Lifecycle product. This issue will affect any RSA Identity Governance & Lifecycle deployment on IBM WebSphere where the latest IBM updates have been applied.
This is a known issue in the following versions of WebSphere:
IBM WebSphere 18.104.22.168 and later running IBM JDK 1.8
IBM WebSphere 22.214.171.124 and later running IBM JDK 1.8
IBM WebSphere 126.96.36.199 and later running IBM JDK 1.7
This issue is resolved in the following patches/versions of RSA Identity Governance & Lifecycle:
RSA Identity Governance & Lifecycle 7.2.0 (upgrade to 7.2.1 or later version and apply the patch where this issue is fixed)
RSA Identity Governance & Lifecycle 7.2.1 P12
RSA Identity Governance & Lifecycle 7.5.0 P07
SecurID Governance & Lifecycle 7.5.2 P03 (see Note1 below)
The following workaround may be used if the official fix for RSA Identity Governance & Lifecycle cannot be applied immediately:
Defer applying the latest IBM fix pack until you can complete the patching of RSA Identity Governance & Lifecycle.
Note that you may apply an IBM WebSphere Interim Fix for a security vulnerability on an earlier WebSphere Fix Pack level that does not break RSA Identity Governance & Lifecycle deployment. For example, applying an Interim Fix as recommended by IBM on the following page should be fine as long as the WebSphere Fix Pack level is earlier than the ones listed above that cause problems with RSA Identity Governance & Lifecycle: https://www.ibm.com/support/pages/node/6445171
This issue is specific to IBM WebSphere and the IBM JRE and is not known to affect deployments on Wildfly or Weblogic.
Note1 - SecurID Governance & Lifecycle 7.5.2 original full installer (build 181918) was replaced with an updated full installer build 182642 (same build as the 7.5.2 P03 patch) in June 2022. Customers who installed 7.5.2 build 181918 before June 2022 need to patch to 7.5.2 P03.