Unable to import new certificate to the Suite Lifecycle locker

Products

• VMware Aria Suite

Issue/Introduction

Importing certificate Aria Suite Lifecycle 8.16 and 8.18 gives error Unable to decrypt key. Please check the provided passphrase.

 

Log snippets : -

ERROR [http-nio-8080-exec-7] c.v.v.l.l.m.RSAKeyPair -  -- Failed to decrypt private key with OpenSSL decryptor.
org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: 1.2.840.113549.1.5.3 not available: Cannot find any provider supporting 1.2.840.113549.1.5.3
at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source) ~[bcpkix-fips-1.0.2.jar:?]

Environment

Aria Suite Lifecycle 8.16

Aria Suite Lifecycle 8.18

Cause

The error we see is caused by the algorithm used on the certificate side, "1.2.840.113549.1.5.3" (Password-Based Encryption with MD2 and DES), which is considered weak and is generally excluded from FIPS compliance. Since Suite Lifecycle is using BouncyCastle FIPS, it fails to decrypt the data.

Disabling FIPS should resolves the issue 

 

 

Resolution

Disable FIPS on the Suite Lifecycle and then try Import Certificate. 

Refer the following Technical documentation for steps how to  Activate or Deactivate FIPS in Suite Lifecycle

Recommendation is to use AES encryption instead of DES for enhanced security when generating certificates.