Symptoms

Consider the following scenario:

  • You create a federation trust between a Microsoft Exchange Server 2010 Service Pack 1(SP1) organization and Microsoft Federation Gateway.

  • The System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing security setting is enabled on the server that is running Exchange Server 2010 SP1.

  • You use the Get-FederatedDomainProof cmdlet to generate a cryptographically secure string for the domain.

In this scenario, the cmdlet fails, and you receive the following error message:


WARNING: An unexpected error has occurred and a Watson dump is being generated: Exception has been thrown by the target of an invocation.
Exception has been thrown by the target of an invocation.

Exception has been thrown by the target of an invocation.
+ CategoryInfo : NotSpecified: (:) [Get-FederatedDomainProof], TargetInvocationException
+ FullyQualifiedErrorId : System.Reflection.TargetInvocationException,Microsoft.Exchange.Management.SystemConfigur
ationTasks.GetFederatedDomainProof


Additionally, the following event is logged on the Exchange Server 2010 SP1 server:


Cause

This issue occurs because the cryptographic algorithm that is used to calculate the hash value of a domain name is not a U.S. Federal Information Processing Standards (FIPS)-certified cryptographic algorithm.

Resolution

To resolve this issue, install the following update rollup:

2661854 Description of Update Rollup 2 for Exchange Server 2010 Service Pack 2

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

More Information

For more information about the System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing security setting is , click the following article number to view the article in the Microsoft Knowledge Base:

811833 System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing For more information about how to create a federation trust, visit the following Microsoft website:

General information about how to create a federation trustFor more information about the Get-FederatedDomainProof cmdlet, visit the following Microsoft website:

General information about the Get-FederatedDomainProof cmdletFor more information about FIPS-compliant algorithms, visit the following Microsoft website:

General information about FIPS compliant algorithms

Potrzebna dalsza pomoc?

Rozwijaj swoje umiejętności
Poznaj szkolenia
Uzyskuj nowe funkcje w pierwszej kolejności
Dołącz do niejawnych testerów firmy Microsoft

Czy te informacje były pomocne?

Co wpłynęło na Twoje wrażenia?

Dziękujemy za opinię!

×