05-06-2016 02:50 AM - edited 03-05-2019 07:01 AM
Hi all,
I'm trying to upgrade an ASR9001 from 5.1.3 to 5.3.3 but the command:
admin install add tar ftp://xx.xxx.xx/ASR9K-iosxr-px-K9-5.3.3.tar fails.
What it says about NTP does not apply (time is right) and about code signing stuff, I really don't know what that means.
The md5 of the tar file is correct.
Any ideas?
Thanx,
Sp
The output is:
RP/0/RSP0/CPU0:R4(admin)#install add tar ftp://ciscoftp:******@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar synchronous
Fri May 6 11:11:18.025 EEST
Install operation 80 '(admin) install add tar /ftp://ciscoftp:*************************@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar synchronous'
started by user 'spiros' via CLI at 11:11:18 EEST Fri May 06 2016.
Info: The following files were extracted from the tar file
Info: '/ftp://ciscoftp:*************************@xx.yy.zz.40/ASR9K-iosxr-px-K9-5.3.3.tar' and will be added to the entire router:
Info:
Info: README-ASR9K-iosxr-px-k9-5.3.3 (skipped - not a pie)
Info: asr9k-video-px.pie-5.3.3
Info: asr9k-services-px.pie-5.3.3
Info: asr9k-services-infra-px.pie-5.3.3
Info: asr9k-optic-px.pie-5.3.3
Info: asr9k-mpls-px.pie-5.3.3
Info: asr9k-mini-px.pie-5.3.3
Info: asr9k-mgbl-px.pie-5.3.3
Info: asr9k-mcast-px.pie-5.3.3
Info: asr9k-li-px.pie-5.3.3
Info: asr9k-fpd-px.pie-5.3.3
Info: asr9k-doc-px.pie-5.3.3
Info: asr9k-bng-px.pie-5.3.3
Info: asr9k-asr901-nV-px.pie-5.3.3
Info: asr9k-asr9000v-nV-px.pie-5.3.3
Info: asr9k-k9sec-px.pie-5.3.3
Info:
Error: Cannot proceed with the add operation because the code signing certificate has expired.
Error: Suggested steps to resolve this:
Error: - check the system clock using 'show clock' (correct with 'clock set' if necessary).
Error: - check the pie file was built within the last 5 years using '(admin) show install pie-info
Error: /tmp/install/tar/instdir/34139816_349000000/asr9k-video-px.pie-5.3.3'.
Error:
Error: The following pies were not added due to an error:
Error: asr9k-video-px.pie-5.3.3
Error: asr9k-services-px.pie-5.3.3
Error: asr9k-services-infra-px.pie-5.3.3
Error: asr9k-optic-px.pie-5.3.3
Error: asr9k-mpls-px.pie-5.3.3
Error: asr9k-mini-px.pie-5.3.3
Error: asr9k-mgbl-px.pie-5.3.3
Error: asr9k-mcast-px.pie-5.3.3
Error: asr9k-li-px.pie-5.3.3
Error: asr9k-fpd-px.pie-5.3.3
Error: asr9k-doc-px.pie-5.3.3
Error: asr9k-bng-px.pie-5.3.3
Error: asr9k-asr901-nV-px.pie-5.3.3
Error: asr9k-asr9000v-nV-px.pie-5.3.3
Error: asr9k-k9sec-px.pie-5.3.3
Install operation 80 failed at 11:30:15 EEST Fri May 06 2016.
05-30-2016 09:10 PM
Hi,
Your problem is covered under CSCut52232 (Signing Certificate Expire by Cct 2015). You need to apply this SMU before you can upgrade to 5.3.3
Before you can apply CSCut52232, you need to add SAM certificate, please follow the link below how to add SAM cert
http://www.cisco.com/c/en/us/td/docs/routers/technotes/MOP-CSS-to-Abraxas.html
Once you have added certificate, you can go and apply SMU CSCut52232 (its hitless i.e. no traffic impact) and only after this SMU you wont get signing error while upgrading. Please let me know if this solves your problem.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide