Error: ”DIGESTS signatures NOT OK” when installing the DLP Linux agent on a FIPS-enabled server

Products

• Data Loss Prevention Core Package
• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

The installation of the DLP 16.0.1 Linux agent fails on a RHEL server.
After importing and displaying the RPM signing key, the command to verify the signature fails.
-Command: rpm -K *rpm
Error: ”DIGESTS signatures NOT OK”

-Command: rpm -K - v8.rpm
Header V4 RSA/SHA256 Signature, key ID <key id number>: OK
Header SHA1 digest: OK
Payload SHA256 digest: NOTFOUND
V4 RSA/SHA256 Signature, key ID <key id number>: OK
MD5 digest: NOTFOUND

Attempts to install the agent fail with this message:

package AgentInstall-16.0.10000.60463-1.x86_64 does not verify: no digest

Attempts to force the install fail.
-Command: rpm --checksig *.rpm
Returns: "DIGESTS signatures NOT OK"

As a last resort, the Linux admin disabled FIPS.
After which the Linux agent was successfully installed following the published guidelines.

Cause

Installing DLP Agent on a FIPS-enabled Linux-system is an unsupported scenario. 

Resolution

We do not support a Linux system running in FIPS mode.  
Our FIPS compliance approach has been through the application, where application layer crypto goes through a FIPS validated module (openssl in our case). 
Enabling the global FIPS mode is going to trigger several issues with the agent, including the agent not working.

There is an open feature request to enable the Linux agent to be installed on a FIPS-enabled server.
If you want to be added to that feature request, please open a case and provide this KB number.