search cancel

Adding second Policy Server pointing to the same Policy and Key Store


Article ID: 127169


Updated On:


CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On SITEMINDER



After adding a second Policy Server (PS2) that is pointing to the same Policy and Key Store of Policy Server 1 (PS1) to the HCO, the below errors in the Policy Server smtracedefault.log start to show up:

  [LogMessage:ERROR:[sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client]

  [Error while fetching previous secret for the Agent abc][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]



The encryption is not the same on both Policy Servers. Comparing the content of the EncryptionKey.txt on both Policy Server shows that they aren't the same.




Siteminder 12.8 SP1 on Windows 2012 R2




  1. Ensure that the Enable Agent Key Generation is disabled on the second policy server 2(PS2);
  2. Stop Policy Server 2(PS2) and then take a backup of the the EncryptionKey.txt from the below directory from Policy Server and rename the EncryptionKey.txt to EncryptionKey.txt_backup (<Policy_server_install_path>)/bin folder);
  3. Copy the EncryptionKey.txt from the below directory from policy server 1 (PS1) to Policy Server 2 (PS2) (<Policy_server_install_path>)/bin folder);
  4. Restart the Policy Server;
  5. Re-enter the password for the DSNs for all the configured stores via the smconsole and test all connections to confirm the connection is successful;
  6. Confirm that there are no more errors in the smps.log;


    This solution is only valid for Policy Servers on Windows platforms. For Policy Servers on Linux platforms, please follow the instructions in the documentation to rest the encryption key (1).

Additional Information



    Reset the r12.x Policy Store Encryption Key