Key generation operation failed

[LCMember4715]

enabled FIPS over the weekend now I get the message : Key generation operation failed - RSA when commiting

[mikand]

Did you use any selfsigned or imported certificates before you enabled FIPS-mode?

Since according to the manual (PAN-OS_4.1_CLI_Reference_Guide.pdf, page 305):

"

Appendix C
Federal Information Processing Standards Support

You can configure the firewall to support the Federal Information Processing Standards 140-2 (FIPS 140-2), which are used by civilian U.S. government agencies and government contractors.

To enable FIPS mode on a software version that supports FIPS, boot the firewall into maintenance mode and then select Set FIPS Mode from the main menu.

For instructions on booting to maintenance mode, refer to the PAN-OS Command Line Interface Reference Guide.

When FIPS is enabled, the following apply:

• To log into the firewall, the browser must be TLS 1.0 compatible.

• All passwords on the firewall must be at least six characters.

• Accounts are locked after the number of failed attempts that is configured on the Device > Setup > Management page. If the firewall is not in FIPS mode, it can be configured so that it never locks out; however in FIPS mode, and lockout time is required.

• The firewall automatically determines the appropriate level of self-testing and enforces the appropriate level of strength in encryption algorithms and cipher suites.

• Non-FIPS approved algorithms are not decrypted and are thus ignored during decryption.

• When configuring IPSec, a subset of the normally available cipher suites is available.

• Self-generated and imported certificates must contain public keys that are 2048 bits (or more).

• SSH key-based authentication must use RSA public keys that are 2048 bits or higher.

• The serial port is disabled.

• Telnet, TFTP, and HTTP management connections are unavailable.

• Surf control is not supported.

• High availability (HA) encryption is required.

• PAP authentication is disabled.

• Kerberos support is disabled.

"

[LCMember4715]

The only certs I have are the localhost self signed for the web gui and the HA certs.

Scott Thompson

National Labor Relations Board

202-273-4097

[mikand]

What if you extract running-config.xml through GUI and with a texteditor search for "rsa" in that file - any thints here (for example ssh keys or such)?