Upgrade Software on a KMA
Upgrading software requires two separate steps: uploading and activating.
- The Operator uploads the software file to the KMA . See Upload the Software Upgrades.
- The Security Officer activates the software version that the Operator uploaded. See Activate a Software Version.
Version Requirements
Use a GUI release that matches the version you want to load on the KMA(s). Always use a newer OKM GUI to activate a newer OKM software version on a KMA.
Handling a Slow Upgrade Process
The upload and apply process can be lengthy if the OKM Manager is remotely connected to the KMA or if the connection between the OKM Manager and KMA is slow. To mitigate this, the software upgrade file can be downloaded to a laptop or workstation that has the OKM Manager installed and the laptop or workstation connected to the same subnet as the KMA. The presence of a router between the OKM Manager and the KMA may slow down the upgrade process.
The upload and apply processes, with a good connection between the OKM Manager and the KMA, optimally take about 30 minutes. The activate process optimally takes about 5 to 15 minutes. If the uploading process is very slow, try connecting to the same subnet as the KMA.
Upload and apply the software upgrade file on each KMA one at a time (to help to spread out the network load), and then activate the software upgrade on each KMA one at a time (to minimize the number of KMAs that are offline concurrently).
If any of the upgrade processes fail (upload, verify, apply, activate, switch replication version), the OKM Manager generates audit messages describing the reason for the failure and a suggested solution.
Master Key Provider Settings
With OKM 3.3.3, OKM-ICSF integration is no longer supported. If your OKM cluster currently defines Master Key Provider settings, you must clear these settings before upgrading a KMA to OKM 3.3.3:
- In the left navigation, expand System Management, then expand Security, and then select Security Parameters.
- Click Master Key Provider ...
- In the Master Key Provider Settings dialog, inspect the Master Key Mode field. If it is set to a value other than Off, click Clear and then Save.
Check the Software Version of a KMA
View the software version running on a specific KMA.
Upload the Software Upgrades
Upload the software package to the KMA so that it can be activated.
- Before upgrading, create a backup (see to Create a Database Backup).
- Download the software upgrade file, and save it to a location accessible to OKM Manager.
- From the Local Configuration menu, select Software Upgrade.
- Click Browse, and locate the upgrade file.
- Click Upload and Apply.
Activate a Software Version
Activate a software version that has been already uploaded and applied.
Upgrade nShield Solo Firmware
If your KMA includes an nShield Solo+ cryptographic card, you must prepare to upgrade the nShield firmware before you activate OKM 3.3.3 on your KMA. After OKM 3.3.3 has been activated, your KMA will not use the nShield Solo+ card and its HSM Status appears as "Not Present" in the KMA List panel of the OKM GUI until the nShield firmware is upgraded.
To prepare to upgrade the nShield Solo+ firmware, first attach a smart card reader to the nShield Solo+ card, insert a smart card into the reader, and ensure that the mode switch is set to Operational (O). Then launch the host console from the KMA's ILOM. Proceed to activate the OKM 3.3.3 software version from the Software Upgrade panel of the OKM GUI. Monitor messages that appear in the host console as the KMA boots.
Near the end of the boot process, look for the following messages in the host console:
Incorrect firmware version 2.61.2 is installed on the nShield Solo+ HSM
nShield HSM Solo+ firmware=2.61.2 and an update is required.
nShield Solo+ HSM firmware upgrade takes approximately 10 minutes
nShield Solo+ firmware=2.61.2, you will not be able to downgrade back to this version after the update
The following prompt appears:
Perform the nShield HSM firmware update(y) or run OKM without an HSM(n)?
Enter y at this prompt. The KMA displays additional messages:
Updating nShield HSM firmware - do NOT power off ...
Loading new nShield HSM module firmware ...
Several seconds later, the KMA displays a message when the firmware upgrade completes:
nShield HSM firmware update is complete.
Note:
If the nShield firmware was not upgraded when the KMA was upgraded to OKM 3.3.3, you can upgrade it later by rebooting the KMA and performing these steps.