Sequential upgrade process

To upgrade from older versions to newer versions, you must upgrade each version step-by-step. 

Example: Starting upgrade from 8.9.0, you must upgrade to 8.6.1 10 and thereafter to 8.711.10. 

Exception: Upgrade from 8.10.0 and earlier

Support for MariaDB version below 10.5 has been removed in version 8.10.0 (and later) of Certificate Manager. If you use MariaDB version below 10.5, you must upgrade before you proceed with the steps below. 

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

2. On the server(s) running the Nexus CF, Nexus CIS, or Nexus SNMP services:

   1. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

   2. Remove the following files from <cm-server-home>/config:

      • requestformats/httpclient.conf

      • http.conf

3. The suggested default log levels for CM-SNMP has been reduced from FINEST to INFO. If you use CM-SNMP and want to change to the new default values, change this in the file <cm-server-home>/config/snmplog.properties.

4. The following deprecated modifiers have been replaced or removed. If you use customized format files, make sure that none of the deprecated modifiers are used.

   1. These deprecated modifiers have been replaced:

      • SubjectKeyIdAdder > SubjectKeyIdentifierModifier

      • ScepUniqueness > RenewalAllowed

      • AltNameModifier > SubjectAltNameModifier

   2. These deprecated modifiers have been removed:

      • CheckCertWithSubject

      • CisFailoverModifier

      • DynamicValidity

      • InputStringBoundChecker

      • MonetaryLimitAttributeModifier

      • PublicKeyHash

      • RelativeValidity

      • ScepUniqueness

      • SubjectIdentifierSs

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

2. On the server(s) running the Nexus CF, Nexus CIS or Nexus SNMP services:

   1. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder. 
      Note the important changes described in the file changes-formats.txt. The file is located here: <Upgrade\Upgrade from CM 8.0.x to 8.1.0\server>. The tool used in changes-formats.txt requires updated lib files. Therefore those instructions should be executed after the new jar files has been replace in the final upgrade instruction.

   2. From Upgrade files CM 8.1.0/server/inputviews, add the following files to <cm-server-home>/inputviews, or replace if any of these files already exist:

      • acme-account-reg-search.conf

      • acme-prereg-search.conf

      • countries.conf

      • device-cert-registration.conf

      • estsecretsearch.conf

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

2. On the server(s) running the Nexus CF, Nexus CIS, or Nexus SNMP services:

   1. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

2. On the server(s) running the Nexus CF, Nexus CIS or Nexus SNMP services:

   1. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

   2. From <Upgrade files CM 8.3.0/server/inputviews>, add the following file to <cm-server-home>/inputviews:

      • scepdynamicpasswordregsearch.conf

1. Make a backup copy of this folder before applying any changes:

   1. <cm-server-home>/config

2. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

3. From Upgrade files CM 8.4.1/server/inputviews, add these files to <cm-server-home>/inputviews:

   1. est-auth-cert.conf

   2. its-station-registration.conf

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

2. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder. 
   Depending on which 8.4.x version you are currently on, some of the changes may already have been performed as part of an earlier upgrade.

3. On the servers running the Nexus CF, Nexus CIS or Nexus SNMP service, remove all jar files in the <cm-server-home>/lib folder.

4. Start the Nexus CIS, CF and SNMP services.

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

2. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

Depending on which 8.5.x version you are currently on, some of the changes may already have been performed as part of an earlier upgrade.

The ability to manually build CRLs and CILs has been moved from the officer role "Use AWB" to its own role in "Manual build of CRL and CIL". As such, if you have officers that should be able to perform manual builds of CXLs, then their officer profiles will need to be updated.

When you upgrade CM from 8.6.x to 8.7.1, execute only the database script in the folder "Upgrade from CM 8.6.x to 8.7.0" in the release bundle.

Do not use the script in the folder "Upgrade from CM 8.7.0 to 8.7.1"

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

2. Do the configuration changes in <cm-server-home>/config/ described in the respective files under the <server> folder.

From 8.7.0 to 8.7.1"

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

   Do the configuration changes in

   1. /deliverynotes

2. Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP and Nexus CIS service in: <cm-server-home>/config/  and <cm-server-home>/configinputviews/ described described in the respective files under the <server> folder.
   From Upgrade files CM 8.7.

1. 1/server/inputviews, add the following file to <cm-server-home>/inputviews:

   • kerberos-pkinit-san.conf

1. Make a backup copy of these folders before applying any changes:before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

2. Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP and Nexus CIS service in: <cm-server-home>/config

   /  and <cm-server-home>

   /lib

3. <cm-server-home>/bin

/inputviews/ described in the respective files under the <server> folder. Depending on which 8.7.x version you are currently on, some of the changes may already have been performed as part of an earlier upgrade.

1. From Upgrade files CM 8.9.0/server/inputviews, add the following files to <cm-server-home>/deliverynotes

Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP and Nexus CIS service in: <cm-server-home>/config/  and <cm-server-home>/inputviews/ described in the respective files under the <server> folder.
From

1. inputviews:

   •  v2x-enroll-enabling-registration.conf

   • kerberos-pkinit-san.conf

2.  From Upgrade files CM 8.

7

1. 9.

1

1. 0/server/

inputviews

1. config, add the following file to <cm-server-home>/

inputviews

1. config:

kerberos-pkinit-san

1. • rapcacsv2.conf

4. Rename any custom formats files used by Certificate Manager that has a filename that begins with  the "_" character to something the does not begin with the "_" character. The reason for this is that formats starting with "_" will not be loaded.

1. Only for upgrades coming from earlier that 8.1.x: Run any steps that may have been postponed in earlier steps, such as those required for "copycacerts" when upgrading from CM 7.17.x or those in changes-format.txt when upgrading from CM 8.0.x.

1. Make a backup copy of these folders before applying any changes:

   1. <cm-server-home>/config

   2. <cm-server-home>/lib

   3. <cm-server-home>/bin

   4. <cm-server-home>/deliverynotes

2. Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP, and Nexus CIS service in: <cm-server-home>/config/  and <cm-server-home>/inputviews/ described in the respective files under the <server> folder. Depending on which

1. Make a backup copy of these folders before applying any changes:
   <cm-server-home>/

   inputviews:

   config
   

    v2x

   <cm-

   enroll-enabling-registration.conf

2. kerberos-pkinit-san.conf

 From Upgrade files CM 8.9.0/server/config, add the following file to

server-home>/lib
<cm-server-home>/bin
<cm-server-home>/

config:

• rapcacsv2.conf

3. Rename any custom formats files used by Certificate Manager that has a filename that begins with  the "_" character to something the does not begin with the "_" character. The reason for this is that formats starting with "_" will not be loaded.

4. Only for upgrades coming from earlier that 8.1.x: Run any steps that may have been postponed in earlier steps, such as those required for "copycacerts" when upgrading from CM 7.17.x or those in changes-format.txt when upgrading from CM 8.0.x.

1. deliverynotes

2. Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP, and Nexus CIS service in: <cm-server-home>/config/  described in the respective files under the <server> folder.

1. Make a backup copy of these folders before applying any changes:
   <cm-server-home>/config
   <cm-server-home>/lib
   <cm-server-home>/bin
   <cm-server

   -home>/deliverynotes

   Make sure 64-bit Java SE 17 is installed and properly configured  to be used by the CF, CIS and SNMP services. See Certificate Manager - requirements and interoperability for more information.-home>/deliverynotes

2. On Linux, if you are upgrading from a Certificate Manager version earlier than 8.9.x, remove the Nexus CIS, CF and SNMP services using the cmservices tool:
     <install_root>/bin/cmservices remove cf
      <install_root>/bin/cmservices remove cis
      <install install_root>/bin/cmservices remove cmsnmp

3. Do the configuration changes on the server(s) running the Nexus CF, Nexus SNMP, and Nexus CIS service in: <cm-server-home>/config/  and <cm-server-home>/inputviews/ described in the respective files under the <server> folder.

4. Rename any custom formats files used by Certificate Manager that has a filename that begins with  the "_" character to something the does not begin with the "_" character. The reason for this is that formats Formats starting with "_" will not be loaded.

5. On the servers running the Nexus CF, Nexus CIS, or Nexus SNMP service, remove all jar files in the <cm-server-home>/lib folder.

6. Copy all jar files in Upgrade files CM 8.911.0/server/lib to <cm-server-home>/lib.

7. Replace all files in <cm-server-home>/tools with the new ones in Upgrade files CM 8.911.0/server/tools.

8. Copy all files in Upgrade files CM 8.911.0/server/bin to <cm-server-home>/bin, replacing the old ones.

9. Copy all files in Upgrade files CM 8.911.0/server/deliverynotes to <cm-server-home>/deliverynotes, replacing the old ones.

10. If you are upgrading from a Certificate Manager version earlier than 8.9.x, you must re-install the cmservices. On Linux, reinstall the Nexus CIS, CF and SNMP services using cmservices tool, replacing "cmuser" with the user who shall run the systemd services:

       <install_root>/bin/cmservices install cf cmuser cmuser
       <install_root>/bin/cmservices install cis cmuser cmuser
       <install_root>/bin/cmservices install cmsnmp cmuser cmuser

11. Only for upgrades coming from earlier that 8.1.x: Run any steps that may have been postponed in earlier steps, such as those required for "copycacerts" when upgrading from CM 7.17.x or those in changes-format.txt when upgrading from CM 8.0.x.

12. Configure java CF to use Make sure 64-bit Java SE 17 is installed and properly configured  to be used by the CF, CIS and SNMP services. See Certificate Manager - requirements and interoperability for more information.

13. Configure services to use Java 17.

    1. On Windows open the Registry Editor. In "HKEY_LOCAL_MACHINE\SOFTWARE\Nexus\Service Parameters\CF<CF/CIS/SNMP>". Edit the variable JREPath so it instead points to Java 17 home directory.

    2. On Linux, navigate to <install_root>/bin and edit the JAVA variable in the <cf/cis/cmsnmp>_launch.conf to point to Java 17.

14. Start the Nexus CIS, CF, and SNMP services.