Okta Access Gateway Upgrade Fails in FIPS Mode Due to Backup Script Output

Prior to Okta Access Gateway (OAG) version 2026.3, an upgrade fails if the backup script generates an output. The failure occurs because the secure random algorithm is not compliant with Federal Information Processing Standards (FIPS). Disable the backup script on the admin node to resolve the issue and allow the upgrade to complete. The management console displays the following error:

Update failed. Review the following and contact Okta support. Severe error! No update process run; review system logs.

The system logs display the following output:

2026-08-17T11:47:48.869-07:00 oag.okta.com OAG ADMIN_CONSOLE SYSTEM UPDATE ERROR RUN [USER="oag-mgmt"] Error while running update process: Failed to backup OAG configuration. Reason: Warning: SecureRandom
java.security.NoSuchAlgorithmException: SHA1PRNG SecureRandom not available
        at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
        at java.base/java.security.SecureRandom.getInstance(SecureRandom.java:389)
        at org.h2.util.MathUtils.getSecureRandom(MathUtils.java:73)
        at org.h2.util.MathUtils.secureRandomBytes(MathUtils.java:294)
        at org.h2.engine.SessionRemote.connectServer(SessionRemote.java:427)
        at org.h2.engine.SessionRemote.connectEmbeddedOrServer(SessionRemote.java:355)
        at org.h2.jdbc.JdbcConnection.<init>(JdbcConnection.java:125)
        at org.h2.util.JdbcUtils.getConnection(JdbcUtils.java:288)
        at org.h2.util.JdbcUtils.getConnection(JdbcUtils.java:270)
        at org.h2.tools.Script.process(Script.java:115)
        at org.h2.tools.Script.runTool(Script.java:99)
        at org.h2.tools.Script.main(Script.java:44)

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Access Gateway (OAG) version 2026.3 and below
• Federal Information Processing Standards (FIPS)
• Upgrades

The java.security.NoSuchAlgorithmException: SHA1PRNG SecureRandom not available error occurs because SHA1PRNG is not compliant with FIPS. Okta generates a warning in the output, which causes the upgrade process to fail. 

How is the Okta Access Gateway upgrade failure resolved?

Navigate to the release notes and follow the documented upgrade instructions by performing these steps.

1. Go to the Okta Access Gateway Release Notes.
2. Follow the upgrade instructions.