Secure License Error: java.security.NoSuchAlgorithmException: PBEWithSHA1AndDESede AlgorithmParameters not available

Applies to

Liquibase Secure (Pro)

Conditions

Any Java/JVM installation that does not provide the PBEWithSHA1AndDESede cipher, including:
- a minimal or embedded JRE
- a JDK distribution with a restricted set of cryptographic providers
- or a hardened/FIPS-configured Java security policy that disables legacy algorithms
Most commonly seen when a valid Liquibase Secure (Pro) license key works in one environment (e.g., a Dev or test server) but fails in another (e.g., Production) that uses a different Java installation, even though the Liquibase version, properties file, and license key are otherwise identical between the two.

Issue Summary

A previously working or newly issued Liquibase Secure (Pro) license key fails to install, even though the key itself is valid and installs successfully in other environments. Liquibase returns a "Could not install license" error and disables Secure (Pro) features.

Error Message

Could not install license from Base64 string starting with '<license-key-prefix>' (property liquibaseProLicenseKey). Please contact sales@liquibase.com

java.io.IOException: java.security.NoSuchAlgorithmException: PBEWithSHA1AndDESede AlgorithmParameters not available

WARNING! You have specified an invalid license key. Liquibase Pro features will remain disabled!

Root Cause

Liquibase decrypts Secure (Pro) license keys using the PBEWithSHA1AndDESede algorithm. This algorithm has to be available from one of the JVM's registered security providers at runtime. If the Java installation running Liquibase doesn't include it, license decryption fails before the key is ever validated, resulting in a "Could not install license" / "invalid license key" message even when the key is correct.

This is easy to miss when comparing environments, because the license key, liquibase.properties file, and Liquibase installation can all look identical between a working and a failing environment. The real difference is which Java installation Liquibase is picking up at runtime (via JAVA_HOME or PATH) in each environment. A JRE or JDK that is missing, restricted, or has legacy algorithms disabled will fail; a standard Oracle JDK or OpenJDK installation typically will not.

Resolution

Confirm the license key itself is not the problem.
- If the same key installs successfully in another environment, or matches the original key issued by Liquibase exactly, the key is not the cause.
Identify which Java installation Liquibase is using in the failing environment.
- Run java -version using the same JAVA_HOME/PATH that Liquibase uses at runtime, and compare the result against a working environment.
Point Liquibase to a standard Oracle JDK or OpenJDK installation, either by updating the JAVA_HOME environment variable used when Liquibase runs, or by updating the Liquibase startup/run script directly.
Re-run the Liquibase command. The license should now install successfully.

If your environment must run a hardened or FIPS-restricted Java security policy and switching to a standard JDK is not an option, contact Liquibase Support so we can help evaluate available options.