Question
Scientific Research Corporation
US
Last activity: 3 Oct 2025 18:12 EDT
Java error during upgrade from 8.8.5 to version 24.2
Trying to perform an upgrade from 8.8.5 to version 24.2 on RHEL 9 and receiving the following error during execution of the upgrade.sh script:
INFO AbstractJvmForker - Caused by: java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES/PCBC/PKCS5Padding
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher.getInstance(Cipher.java:571)
INFO AbstractJvmForker - at com.pega.platform.securitycore.encryption.internal.CipherBase.getCipherInstance(CipherBase.java:178)
INFO AbstractJvmForker - ... 79 more
INFO AbstractJvmForker - Caused by: java.security.NoSuchAlgorithmException: PCBC not found
INFO AbstractJvmForker - at org.bouncycastle.jcajce.provider.BaseCipher.engineSetMode(Unknown Source)
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher$Transform.setModePadding(Cipher.java:385)
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher.getInstance(Cipher.java:564)
INFO AbstractJvmForker - ... 80 more
Exception in thread "main" java.lang.RuntimeException: Java process exited with 1
at com.pega.deploy.fork.AbstractJvmForker.waitForProcessExit(AbstractJvmForker.kt:98)
at com.pega.deploy.fork.AbstractJvmForker.runBlocking(AbstractJvmForker.kt:104)
Trying to perform an upgrade from 8.8.5 to version 24.2 on RHEL 9 and receiving the following error during execution of the upgrade.sh script:
INFO AbstractJvmForker - Caused by: java.security.NoSuchAlgorithmException: Cannot find any provider supporting AES/PCBC/PKCS5Padding
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher.getInstance(Cipher.java:571)
INFO AbstractJvmForker - at com.pega.platform.securitycore.encryption.internal.CipherBase.getCipherInstance(CipherBase.java:178)
INFO AbstractJvmForker - ... 79 more
INFO AbstractJvmForker - Caused by: java.security.NoSuchAlgorithmException: PCBC not found
INFO AbstractJvmForker - at org.bouncycastle.jcajce.provider.BaseCipher.engineSetMode(Unknown Source)
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher$Transform.setModePadding(Cipher.java:385)
INFO AbstractJvmForker - at java.base/javax.crypto.Cipher.getInstance(Cipher.java:564)
INFO AbstractJvmForker - ... 80 more
Exception in thread "main" java.lang.RuntimeException: Java process exited with 1
at com.pega.deploy.fork.AbstractJvmForker.waitForProcessExit(AbstractJvmForker.kt:98)
at com.pega.deploy.fork.AbstractJvmForker.runBlocking(AbstractJvmForker.kt:104)
at com.pega.deploy.rulebase.UpgradeRuleBaseKt.importUpgradeArchive(UpgradeRuleBase.kt:54)
at com.pega.deploy.rulebase.UpgradeRuleBaseKt.importUpgradeArchive$default(UpgradeRuleBase.kt:40)
at com.pega.deploy.rulebase.UpgradeRuleBaseKt.upgradeRuleBase$lambda$1$lambda$0(UpgradeRuleBase.kt:26)
at com.pega.deploy.SetupDatabase.withProgressTimestamp(SetupDatabase.kt:344)
at com.pega.deploy.rulebase.UpgradeRuleBaseKt.upgradeRuleBase$lambda$1(UpgradeRuleBase.kt:25)
at com.pega.deploy.SetupDatabase.runResumably(SetupDatabase.kt:355)
at com.pega.deploy.rulebase.UpgradeRuleBaseKt.upgradeRuleBase(UpgradeRuleBase.kt:24)
at com.pega.deploy.UpgradeKt.rulesUpgrade(Upgrade.kt:120)
at com.pega.deploy.UpgradeKt.main(Upgrade.kt:46)
at com.pega.deploy.UpgradeKt.main(Upgrade.kt)
Java Process returned a non 0 value
Updated: 15 Sep 2025 9:38 EDT
Pegasystems Inc.
US
@MatthewO1641 Which version of java is being used? I think this should be java 17 since that is required for Infinity '24
Scientific Research Corporation
US
@PhilipShannon Tried with Java 17 and Java 21 with the same result.
Pegasystems Inc.
US
@MatthewO1641 Are there any additional logfiles with errors that you can share? thank you
HCA Healthcare
US
This happens because your JVM on RHEL 9 doesn’t support the legacy cipher mode PCBC, but your 8.8.5 system is configured to use AES/PCBC/PKCS5Padding, so the upgrade tool fails when it tries to initialize that cipher. First, in 8.8.5, check your DSS/prconfig for the platform cipher setting (look for anything pointing to AES/PCBC/PKCS5Padding). Change it to a supported mode, e.g., AES/CBC/PKCS5Padding (safe default) or, if you’re moving to stronger settings in 24.2, AES/GCM/NoPadding. Use the Platform Cipher/Encryption utilities to re-encrypt platform/master keys and any encrypted data with the new cipher, then restart the nodes. If your OS/JDK is running in FIPS mode, prefer AES/GCM and the approved provider (BCFIPS) or disable FIPS just for the upgrade JVM. Make sure the upgrade uses a supported JDK (Java 17, e.g., Temurin) and that no custom JCE policy or missing provider jars are blocking AES/CBC/GCM. Clear caches/temp, rerun upgrade.sh, and the NoSuchAlgorithmException should disappear.