spring-projects/spring-security · error · IllegalStateException
No SHA implementation available!
Error message
No SHA implementation available!
What it means
getSha requests the plain "SHA" (SHA-1) MessageDigest and rethrows NoSuchAlgorithmException as IllegalStateException("No SHA implementation available!"). Every compliant JDK must provide SHA-1, so this indicates a fundamentally broken or non-standard Java runtime with no SHA-capable security provider installed. The exception deliberately loses the original cause, which makes diagnosing provider problems harder.
Source
Thrown at crypto/src/main/java/org/springframework/security/crypto/password/LdapShaPasswordEncoder.java:118
private String encode(CharSequence rawPassword, byte @Nullable [] salt) {
MessageDigest sha = getSha(rawPassword);
if (salt != null) {
sha.update(salt);
}
byte[] hash = combineHashAndSalt(sha.digest(), salt);
String prefix = getPrefix(salt);
return prefix + Utf8.decode(Base64.getEncoder().encode(hash));
}
private MessageDigest getSha(CharSequence rawPassword) {
try {
MessageDigest sha = MessageDigest.getInstance("SHA");
sha.update(Utf8.encode(rawPassword));
return sha;
}
catch (java.security.NoSuchAlgorithmException ex) {
throw new IllegalStateException("No SHA implementation available!");
}
}
private String getPrefix(byte @Nullable [] salt) {
if (salt == null || salt.length == 0) {
return this.forceLowerCasePrefix ? SHA_PREFIX_LC : SHA_PREFIX;
}
return this.forceLowerCasePrefix ? SSHA_PREFIX_LC : SSHA_PREFIX;
}
private byte[] extractSalt(String encPass) {
String encPassNoLabel = encPass.substring(6);
byte[] hashAndSalt = Base64.getDecoder().decode(encPassNoLabel.getBytes());
int saltLength = hashAndSalt.length - SHA_LENGTH;
byte[] salt = new byte[saltLength];
System.arraycopy(hashAndSalt, SHA_LENGTH, salt, 0, saltLength);
return salt;
}View on GitHub (pinned to 96852e8860)
Solutions
- Restore the default SUN security provider or add "security.provider.1=sun.security.provider.Sun" back in the java.security file.
- Verify with MessageDigest.getInstance("SHA") in a plain main() to confirm the runtime itself is the problem.
- Run on a standard JDK/JRE distribution that includes SHA-1 support instead of a custom minimal image.
Example fix
// before (custom java.security) #security.provider.1=sun.security.provider.Sun // after security.provider.1=sun.security.provider.Sun
Defensive patterns
Strategy: try-catch
Validate before calling
try { MessageDigest.getInstance("SHA"); } catch (java.security.NoSuchAlgorithmException e) {
throw new IllegalStateException("JVM lacks SHA provider; fix java.security config");
} Try / catch
try {
encoder.encode(rawPassword);
} catch (IllegalStateException e) {
if (e.getMessage().contains("No SHA implementation")) {
// alert: JVM provider configuration is broken; fail fast / restore providers
}
} Prevention
- Do not strip the SUN provider from java.security in production images.
- Run a startup smoke test that hashes a probe string with every encoder in use.
When it happens
Trigger: Calling encode or matches on LdapShaPasswordEncoder in a JVM where MessageDigest.getInstance("SHA") fails because security providers are stripped, misconfigured, or replaced (e.g. restricted FIPS-only runtime without "SHA" alias).
Common situations: Custom java.security configuration removing the SUN provider; embedding the library in a heavily hardened or minimal runtime image; provider registration failures at JVM startup.
Understand the failure class
Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.
Related errors
- No such hashing algorithm
- Iterations value must be greater than zero
- Invalid algorithm '{algorithmName}'.
- Could not create hash
- Failed find SHA1PRNG algorithm!
AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10).
Data as JSON: /api/errors/c7353f4abe2bea11.
Report an issue: GitHub.