Okta Access Gateway Upgrade Fails in FIPS Mode Due to Backup Script Output

Prior to Okta Access Gateway (OAG) version 2026.3, an upgrade fails if the backup script generates an output because the default algorithm for backing up the UI database is not Federal Information Processing Standards (FIPS) compliant. Use the updated instructions from the release notes for FIPS-enabled systems to allow the upgrade to complete. The management console displays the following error:

Update failed. Review the following and contact Okta support. Severe error! No update process run; review system logs.

The system logs display the following output:

2026-08-17T11:47:48.869-07:00 oag.okta.com OAG ADMIN_CONSOLE SYSTEM UPDATE ERROR RUN [USER="oag-mgmt"] Error while running update process: Failed to backup OAG configuration. Reason: Warning: SecureRandom
java.security.NoSuchAlgorithmException: SHA1PRNG SecureRandom not available
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
        at java.base/java.security.SecureRandom.getInstance(SecureRandom.java:389)
        at org.h2.util.MathUtils.getSecureRandom(MathUtils.java:73)
        at org.h2.util.MathUtils.secureRandomBytes(MathUtils.java:294)
        at org.h2.engine.SessionRemote.connectServer(SessionRemote.java:427)
        at org.h2.engine.SessionRemote.connectEmbeddedOrServer(SessionRemote.java:355)
        at org.h2.jdbc.JdbcConnection.<init>(JdbcConnection.java:125)
        at org.h2.util.JdbcUtils.getConnection(JdbcUtils.java:288)
        at org.h2.util.JdbcUtils.getConnection(JdbcUtils.java:270)
        at org.h2.tools.Script.process(Script.java:115)
        at org.h2.tools.Script.runTool(Script.java:99)
        at org.h2.tools.Script.main(Script.java:44)

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG) version 2026.3 and below
• Federal Information Processing Standards (FIPS)
• Upgrades

The default algorithm for backing up the UI database is SHA1PRNG, which is not a FIPS-compliant algorithm. OAG enables FIPS in Java Virtual Machine (JVM) mode, causing OAG to use the default algorithm after an exception occurs. Okta ignores the warning and completes the backup successfully. However, this behavior creates an issue with the upgrade process.

How is the Okta Access Gateway upgrade failure resolved?

Navigate to the Okta Access Gateway release notes and follow the documented upgrade instructions for FIPS-enabled systems.

1. Go to the Okta Access Gateway Release Notes.
2. Follow the upgrade instructions.