FIPS validation fails causing NSX Manager unavailability

Products

• VMware NSX

Issue/Introduction

• The NSX Manager UI is not responding.  No error is provided, but the interface does not load.
• SSH to the manager is successful and you can login to the CLI.
• As the admin user on the CLI, the services appear to be running when executing:
  

  get services

• As the admin user on the CLI, the status to the other managers is "Connected" when executing:

  get cluster status

• As the root user on the CLI, execute:

  grep "proportionate test failed" syslog

  This situation applies if there are matching results that include org.bouncycastle.crypto.fips.FipsOperationError: proportionate test failed

Environment

VMware NSX 4.2.x and later

Cause

Modules running on the NSX Manager are FIPS compliant and use a cryptographic module to ensure this compliance.

The error "org.bouncycastle.crypto.fips.FipsOperationError: proportionate test failed" indicates that BouncyCastle's FIPS-certified cryptographic module failed its continuous self-testing requirements. This is a built-in safety mechanism in FIPS 140-2/140-3 certified cryptographic modules.

When this self-test fails, modules running on NSX Manager enter an error state, preventing normal operation.

Resolution

Workaround:

Reboot the NSX Manager node where we observe the error: org.bouncycastle.crypto.fips.FipsOperationError.