IBM Support

Openssl Stack Error while running Installation Manager operations on FIPS-enabled systems

Troubleshooting


Problem

On machines with FIPS enabled, customers can get an Openssl error while running IBM Installation Manager commands such as  installc, userinstc, groupinstc, imcl, etc.  This error can occur when you install or update a package, or when you install, update or  re-install the  Installation Manager.

Symptom


An OpenSSL error occurred
error:060800C8:digital envelope routines:EVP_DigestInit_ex:disabled for FIPS
java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: MD5, provider: SUN, class: sun.security.provider.NativeMD5)
        at java.base/java.security.Provider$Service.newInstance(Unknown Source)
        at java.base/sun.security.jca.GetInstance.getInstance(Unknown Source)
        at java.base/sun.security.jca.GetInstance.getInstance(Unknown Source)
        at java.base/java.security.Security.getImpl(Unknown Source)
        at java.base/java.security.MessageDigest.getInstance(Unknown Source)
        at com.ibm.cic.common.core.artifactrepo.impl.ContentInfoComputation.computeDigests(ContentInfoComputation.java:338)
..
Caused by: java.security.ProviderException: Error in Native Digest
        at java.base/sun.security.provider.NativeDigest.<init>(Unknown Source)
        at java.base/sun.security.provider.NativeMD5.<init>(Unknown Source)

Cause

A change was made in Java Semeru that is included in the IBM Installation Manager version 1.10 and beyond that requires a new parameter to be included when running on a FIPS-enabled operating system.  The issue can be resolved by making the simple .ini change described below.
Details of the IBM Semeru change are documented here:  FIPS certified cryptography in IBM Semeru Runtimes.

Resolving The Problem

In order to resolve the issue, update the .ini file that corresponds to the Installation Manager command in use; if it is installc, edit the installc.ini, imcl, edit imcl.ini, etc, and add the following line at the end of file:
-Dsemeru.fips=true
Save the .ini file and try the Installation Manager command again.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSDV2W","label":"IBM Installation Manager"},"ARM Category":[{"code":"a8m3p000000PCNXAA4","label":"INSTALLATION-CONFIGURATION-MIGRATION"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
02 May 2025

UID

ibm17232424

Page Feedback