Symptoms

Consider the following scenario:

  • You create a federation trust between a Microsoft Exchange Server 2010 Service Pack 1(SP1) organization and Microsoft Federation Gateway.

  • The System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing security setting is enabled on the server that is running Exchange Server 2010 SP1.

  • You use the Get-FederatedDomainProof cmdlet to generate a cryptographically secure string for the domain.

In this scenario, the cmdlet fails, and you receive the following error message:


WARNING: An unexpected error has occurred and a Watson dump is being generated: Exception has been thrown by the target of an invocation.
Exception has been thrown by the target of an invocation.

Exception has been thrown by the target of an invocation.
+ CategoryInfo : NotSpecified: (:) [Get-FederatedDomainProof], TargetInvocationException
+ FullyQualifiedErrorId : System.Reflection.TargetInvocationException,Microsoft.Exchange.Management.SystemConfigur
ationTasks.GetFederatedDomainProof


Additionally, the following event is logged on the Exchange Server 2010 SP1 server:


Cause

This issue occurs because the cryptographic algorithm that is used to calculate the hash value of a domain name is not a U.S. Federal Information Processing Standards (FIPS)-certified cryptographic algorithm.

Resolution

To resolve this issue, install the following update rollup:

2661854 Description of Update Rollup 2 for Exchange Server 2010 Service Pack 2

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing security setting is , click the following article number to view the article in the Microsoft Knowledge Base:

811833 System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing For more information about how to create a federation trust, visit the following Microsoft website:

General information about how to create a federation trustFor more information about the Get-FederatedDomainProof cmdlet, visit the following Microsoft website:

General information about the Get-FederatedDomainProof cmdletFor more information about FIPS-compliant algorithms, visit the following Microsoft website:

General information about FIPS compliant algorithms

Kas vajate veel abi?

Täiendage oma oskusi
Tutvuge koolitusmaterjalidega
Kasutage uusi funktsioone enne teisi
Liitu Microsofti Insideri programmis osalejad

Kas sellest teabest oli abi?

Mis mõjutas teie kasutuskogemust?

Täname tagasiside eest!

×