Product Documentation

    Users on SKFS versions prior to 4.16 must first upgrade to 4.16 using the upgrade-skfs.sh script from the 4.16.0 distribution. After a successful upgrade to 4.16, you can then proceed directly to SKFS 4.20.1.

     

    As mentioned in the SKFS v4.20.1 release notes, upgrading to this patch requires that the SKFS administrator perform a set of steps to properly upgrade their SKFS environment to v4.20.1.

     

    The manual steps in the table below are not required if any of the following are true:

    • The SKFS Cluster consists of a single node.

    • The Digital Asset Links feature is not in use.

    • Signature verification is disabled across all nodes.


    In these cases, proceed directly to the standard SKFS v4.20.1 upgrade script.

     

    Step #

    Instruction

    1

    Disable signature verification on node 1

    shell> vi /usr/local/strongkey/skfs/etc/skfs-configuration.properties

    Add/update the following property and set it to 'false':

    skfs.cfg.property.db.signature.rowlevel.verify=false

    2

    Restart Payara on node 1

    shell> sudo systemctl restart payara

    3

    (META) Direct all live SKFS traffic to node 1

    4

    Upgrade all nodes in the cluster except node 1

    shell> ./path/to/upgrade-skfs.sh

    After upgrading the remaining nodes, verify that all fingerprints have been loaded by searching logs for FIDO-MSG-9011.

    5

    Run the SKFSTableSigner.jar CLI client to re-sign the 'digital_asset_link_x509_fingerprints' table on ONE of the upgraded nodes

    shell> /usr/local/strongkey/payara7/glassfish/bin/appclient -client /path/to/SKFSTableSigner/SKFSTableSigner.jar -did 1 -t DIGITAL_ASSET_LINK_X509_FINGERPRINTS -v

    NOTE: It is important that this CLI tool is run only a single time across the cluster on one of the upgraded nodes. The updated signatures will be replicated to all other nodes in the SKFS cluster.

    6

    Wait until the replication queue is empty on node 1

    shell> repl

    If the above command results in empty output, then the replication queue is empty.

    7

    (META) Direct all live SKFS traffic to one of the upgraded nodes (not node 1)

    8

    Upgrade node 1

    shell> ./path/to/upgrade-skfs.sh

    9

    Re-enable signature verification on node 1 

    shell> vi /usr/local/strongkey/skfs/etc/skfs-configuration.properties

    Remove/update the following property and set it to 'true':

    skfs.cfg.property.db.signature.rowlevel.verify=true

    10

    Restart Payara on node 1

    shell> sudo systemctl restart payara

    11

    (META) Put all nodes back into live traffic rotation