.Adding a RHEL 9 replica in FIPS mode to an IdM deployment in FIPS mode that was initialized with RHEL 8.6 or earlier fails The default RHEL 9 FIPS cryptographic policy aiming to comply with FIPS 140-3 does not allow the use of the AES HMAC-SHA1 encryption types' key derivation function as defined by RFC3961, section 5.1. This constraint is a blocker when adding a RHEL 9 Identity Management (IdM) replica in FIPS mode to a RHEL 8 IdM environment in FIPS mode in which the first server was installed on a RHEL 8.6 system or earlier. This is because there are no common encryption types between RHEL 9 and the previous RHEL versions, which commonly use the AES HMAC-SHA1 encryption types but do not use the AES HMAC-SHA2 encryption types. You can view the encryption type of your IdM master key by entering the following command on the server: [subs="quotes"] ---- # kadmin.local getprinc K/M | grep -E '^Key:' ---- To work around the problem, enable the use of AES HMAC-SHA1 on the RHEL 9 replica: [subs="quotes"] ---- update-crypto-policies --set FIPS:AD-SUPPORT ---- WARNING:: This workaround might violate FIPS compliance. As a result, adding the RHEL 9 replica to the IdM deployment proceeds correctly. Note that there is ongoing work to provide a procedure to generate missing AES HMAC-SHA2-encrypted Kerberos keys on RHEL 7 and RHEL 8 servers. This will achieve FIPS 140-3 compliance on the RHEL 9 replica. However, this process will not be fully automated, because the design of Kerberos key cryptography makes it impossible to convert existing keys to different encryption types. The only way is to ask users to renew their passwords.