Issue
If you configure your WatchGuard Management Server to validate the domain controller’s SSL certificate for Active Directory Authentication, certificate validation fails if the Active Directory server has a certificate with an RSASSA-PSS signature.
When this occurs, user authentication fails and you can see a log message like this in the application event logs or Management Server log messages:
Error (8203), Authentication failed; (error:0D0C50A1:asn1 encoding routines:ASN1_item_verify:unknown message digest algorithm) <wmserver_auth peer='127.0.0.1' /> (permission denied)
Workaround/Solution
In the Management Server section of WatchGuard Server Center, select the Active Directory tab and clear the Validate the domain controller’s SSL certificate checkbox.
