Article Number
000039569
Applies To
RSA Product Set: SecurID Access
RSA Product/Service Type: Cloud Authentication Service
RSA Version/Condition: Identity Router running SLES12 SP5
Issue
The following issues are experienced on an identity router running SLES12 SP5:
ERROR: (0) via: ERROR: Failed to get the handle.
ERROR: (0) via: ERROR: Rest authenticate call failed!
AND
The following message is seen in the identity router's symplified.log after publishing changes in the Cloud Administration Console with the identity router in debug mode:
[ServiceMonitor] DEBUG com.symplified.platform.linux.LinuxCmd[128] - Linux command returned response: LinuxCommandResponse [exitCode=0, output=Importing customer certs to NSS DB..
unable to load private key
140651206968976:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:697:Expecting: ANY PRIVATE KEY
pk12util: PKCS12 decode not verified: SEC_ERROR_BAD_DER: security library: improperly formatted DER-encoded message.
pk12util: PKCS12 decode validate bags failed: SEC_ERROR_INVALID_ARGS: security library: invalid arguments.
Task completed.
, error=null, timeout=false]
Cause
There is an incompatibility between the identity router and the encoding of the private key that is uploaded on the: Cloud Administration Console > My Account > Company Settings > Company Information page.
Resolution
Use an encoding conversion utility to convert the encoding of the private key to ASCII encoding. Upload the converted private key to the Company Information page and then save and publish the changes in the Cloud Administration Console.
Notes
To place the identity router in debug mode, see the following page:
Set the Identity Router Logging Level.
The radius.log and symplified.log can be viewed by:
- Access the IDR through SSH (Access SSH for Identity Router Troubleshooting)
- Run the following command to generate a log bundle on the identity router: bundlelogs
- Copy the log bundle off of the identity router and then view the two log files:
- /var/log/radius/radius.log
- /var/log/symplified/symplified.log
The identity router has the "iconv" encoding conversion utility on it. To use this utility to convert the private key, the following can be done:
- Copy the private key to the IDR's /tmp directory.
- SSH to the IDR.
- Gain root access on the IDR. (For steps on how to do this, Contact RSA Support)
- Run the following command:
- iconv -c -f UTF8 -t ASCII /tmp/<original_private.key> -o /tmp/<converted_private.key>
- Copy the converted private key off of the IDR and delete the private key files from the IDR's /tmp directory.