Loading Firmware on the Device
The Junos OS 17.4R1-S1 FIPS images only accept the firmware signed with ECDSA and rejects any firmware signed with RSA+SHA1. You cannot downgrade to images that are signed with RSA+SHA1 from "ECDSA signed only” images. In this scenario, the vSRX device does not load the firmware. The firmware load also fails if the embedded certificates in the firmware image is invalid.