Getting fips error starting Access Gateway after upgrade

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• SITEMINDER

Issue/Introduction

Post upgradation of the CA Access Gateway(SPS) but when customer trying to start the Access Gateway Service it does not initialized and observed the below error message in ' Server.log '. 

[06/Jan/2021:14:52:10-481] [ERROR] - Caused by: java.lang.ExceptionInInitializerError
[06/Jan/2021:14:52:10-481] [ERROR] -    at com.ca.sso.smcert.bc.BCUtilities.getSecureRandom(BCUtilities.java:482)
[06/Jan/2021:14:52:10-481] [ERROR] -    at com.ca.sso.smcert.bc.BCCertImpl.getSecureRandom(BCCertImpl.java:571)
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.ca.sso.smcert.SMCertFactory.getSecureRandom(SMCertFactory.java:423)
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.netegrity.util.TokenGenerator.<init>(Unknown Source)
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.netegrity.util.TokenGenerator.getInstance(Unknown Source)
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.netegrity.proxy.session.SimpleURLSessionScheme.<init>(Unknown Source)
[06/Jan/2021:14:52:10-482] [ERROR] -    ... 16 more
[06/Jan/2021:14:52:10-482] [ERROR] - Caused by: java.lang.IllegalArgumentException: Invalid FIPS mode [ ] Provided
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.ca.sso.FipsMode.<clinit>(FipsMode.java:39)

 

Environment

Secure Proxy Server: 12.8.x

Cause

[06/Jan/2021:14:52:10-482] [ERROR] - Caused by: java.lang.IllegalArgumentException: Invalid FIPS mode [ ] Provided
[06/Jan/2021:14:52:10-482] [ERROR] -    at com.ca.sso.FipsMode.<clinit>(FipsMode.java:39)

FIPS mode might be missing in "ca_sps_env.bat" environment variable file.

 

Resolution

Check the environment variable file under  "<SPS Home>\CA\secure-proxy\ca_sps_env.bat"

Make sure you have the below: 

For example:  

set APACHE_SERVICE_NAME=CA Access Gateway Proxy
set SPS_JAVA_HOME=C:\Program Files\Java\jdk1.8.0_131
set NETE_SPS_ROOT=C:\Program Files\CA\secure-proxy
set CA_SM_PS_FIPS140=COMPAT
set PATH=%NETE_SPS_ROOT%\agentframework\bin;%PATH%
if "%CA_SM_PS_FIPS140%" =="ONLY" set OPENSSL_FIPS=1
set CA_SPS_CP_RESOURCES=%NETE_SPS_ROOT%\resources

We have observed in some cases the value is blank which causes the issue so add the FIPS mode based on the requirement and restart the service.