vCenter RSA SecurID authentication is not functioning

Products

• VMware vCenter Server

Issue/Introduction

• Unable to authenticate to vCenter using RSA SecurID.
  
  
• vCenter SecurID RSA agent module fails to initialize SSLContext.

 

vcsa# tail -f /var/log/vmware/sso/rsa_securid.log

[2026-07-02 20:09:51,212] FATAL tomcat-http--23 - RSA Authentication API for Java v8.6.0.0.0[75] started
[2026-07-02 20:09:51,472] INFO tomcat-http--23 - FIPS-140 Mode Enabled. Running RSA BSAFE Crypto-J JSAFE and JCE Software Module CRYPTOJ 6.1.3.3 20160524
 0700 Self-Tests: PASSED State: OPERATIONAL Level: 1
[2026-07-02 20:09:51,474] INFO tomcat-http--23 - sdopts.rec doesn't exist
[2026-07-02 20:09:51,474] INFO tomcat-http--23 - securid doesn't exist
[2026-07-02 20:09:51,528] DEBUG tomcat-http--23 - Added JAXB context for : com.rsa.authmgr.commonagent.xsd.bootstrap
[2026-07-02 20:09:51,536] INFO tomcat-http--23 - {AgentCryptoJProvider.getJSafeType} CryptoJFIPS.jar is in classpath, using that to invoke FIPS version of JSafe functions
[2026-07-02 20:09:51,543] DEBUG tomcat-http--23 - ACEServerDataObject.getData error: /storage/log/vmware/vmon/securid (No such file or directory)
[2026-07-02 20:09:51,543] DEBUG tomcat-http--23 - Can't get nodeSecret
[2026-07-02 20:09:51,543] INFO tomcat-http--23 - {AuthSessionFactory} Initializing Configuration data
[2026-07-02 20:09:51,557] ERROR tomcat-http--23 - SSLContext has not been initialized.

 

Environment

vCenter Server 8.x

Cause

When you activate FIPS, vCenter Server supports only cryptographic modules for federated authentication. As a result, RSA SecureID and some CAC cards no longer function.

 

In /var/log/vmware/sso/rsa_securid.log we will see FIPS enabled message followed by symptom error "SSLContext has not been initialized".

[2026-07-02 20:09:51,472] INFO tomcat-http--23 - FIPS-140 Mode Enabled

..
[2026-07-02 20:09:51,557] ERROR tomcat-http--23 - SSLContext has not been initialized.

 

 

Resolution

Disable vCenter FIPS to configure and use RSA SecurID Authentication. 

You can activate or deactivate FIPS-validated cryptography on the vCenter Server Appliance by using HTTP requests. FIPS-validated cryptography is deactivated by default.

 

Additional Information

This article describes how to integrate RSA with VMware vSphere/vCenter as an Authentication Agent.