Troubleshooting "Unsupported curveId: 29" connection errors in Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article provides instructions for resolving "Unsupported curveId: 29" errors that occur when establishing JNDI (DYN) Connector connections. This issue typically results from a cipher negotiation mismatch between the client and server following security policy updates in the Java runtime environment.

Environment

Identity Manager 14.5

Cause

The error "Unsupported curveId: 29" indicates that the Java Connector Server (JCS) and the target endpoint cannot agree on a mutually supported cipher suite during the TLS handshake process, often due to strict security settings in the java.security file.

Resolution

To resolve this connection failure, modify the Java security configuration:

1. Locate the JCS Java Path: Identify the JDK/JVM currently used by the JCS by checking the Windows registry: HKLM\SOFTWARE\Wow6432Node\ComputerAssociates\Identity Manager\Procrun 2.0\im_jcs\Parameters\Java
2. Edit java.security: Navigate to the lib/security/ directory of the identified JDK/JVM and open java.security in a text editor.
3. Update Security Algorithms: Locate the following lines and modify them to allow broader compatibility:
   • Original: jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024 jdk.tls.disabledAlgorithms=SSLv3,ECDH, ECDHE, RC4, DH keySize < 768
   • Updated: jdk.certpath.disabledAlgorithms=MD2,MD5, RSA keySize < 1024 jdk.tls.disabledAlgorithms=SSLv3, RC4,MD5withRSA, DH keySize < 768
4. Restart JCS: Save the file and restart the Java Connector Server (JCS) service for changes to take effect.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.