Question about SSL key size in FIPS mode

Hello -

I just ran into a problem with a BCFIPS SSL client where it failed to
establish the connection because the server and CA certificates' keys are
4096 bits long (and, btw, it was NOT easy to get a meaningful error
message). The BCFIPS security policy states the only valid RSA key lengths
are 2048 and 3072, and a 4096-bit key can be used only for signature
verification.

But I don't see anything in the FIPS implementor's guide that would
disallow 4096-bit keys. Can you help me to understand that?

I'm using bcfips-101 and bctls-fips-104's
BouncyCastleJsseProvider("fips:BCFIPS") provider.

Thanks -
Ernie