Dolby Cert download error

[angela]

Hi Carl / team / All DCP-0-matic pro users,

I recently not able to download Dolby Certs inside DCP-0-matic.

Under Make KDM>Add Screen>Download>
I selected Dolby and entered the rating authority's serial number 249433 (it worked a few days ago, downloaded the cert and I can generate KDM).
But today, nomatter what series number I enter, it returns an error like this:

"Download failed (ftp://ftp.cinema.dolby.com/Certificates ... icerts.zip error 78)"

[carl]

Hi, that file is not there any more, indeed. Perhaps they renamed all the files? It looks like that same certificate ZIP is now called Dolby-DCP2000-249433.dcicerts.zip

I can change the DCP-o-matic code to look for that new format.

[Carsten]

Hi Angela - you can still try the manual method:


http://www.dolbycustomer.com/cinema/Certificates

[Jaume(Dolby)]

Hi, FYI, all DCP2000 certs expire at end of current year.
Dolby is upgrading certificates , name can change
J

[carl]

That would explain it, thanks Jaume! I've fixed this locally and it will be in the next release.

[scorpio81]

Hi Jaume!
And what will happen when these certs expire? What will happen if I generate KDM using an expired cert? Hope we don't need to upgrade our cinema servers as well

[Carsten]

All Doremi/legacy 'Dolphin' based product certs expire at the end of 2025 - that is Dolphin 1.0/Dolphin1.2 (DCP-2000, DCP-2K4), ShowVault/IMB, IMS1000, IMS2000. Dolby has issued a statement a while ago that they are working on an in-the-field procedure to extend these certs. Since then, I haven't heard about the proceeding. Maybe it will be possible to extend the validity window only. But even then, the public certs have to be renewed. I guess Dolby is in the process of doing that. I would think that you can continue to create KDMs for existing devices as long as they have not yet undergone Dolbys field cert update procedure. From then on, you would have to issue new KDMs based on new certs. Maybe Dolby will have both certs available for a certain time.

[Jaume(Dolby)]

It'a Clear that Initial Doremi engineers not spect that Dophin lives 15 Years!!!!

A firmware update patch MUST be installed kn ALL equipment involved BEFORE INTERNAL PRIVATE certificate goes end of life
This update install a new PRIVATE certificate

If not patched, ALL KDMs issued will be REFUSED by equipment involved after death date.
perhaps need a "Factory" Revival.

J

[Jaume(Dolby)]

FYI

Dolby Laboratories is proud to announce...
=====================================
The general availability of the Certificatextension Program, along with the supporting Software and Security Manager versions for legacy media blocks. Our DCP2000, DCP2K4, Doremi IMB, IMS1000, and IMS2000 servers, have Media Block certificates that were designed to expire in December 2025. The Certificate Extension Program enables you to extend the expiry to January 14th, 2038, at no cost.

With these new releases, we will also address a recently discovered a Time Critical Issue that prevents the system from using its Secure time (RTC) after January 1st, 2024. Failure to upgrade will result in missed shows or unrecoverable hardware.

What to do?

These releases are available on ftp.cinema.dolby.com (username: service) and address both the Certificate Extension and the RTC date-related issue so you can use your Dolby servers as long as possible. It is highly recommended to upgrade all the affected media blocks before January 1st, 2024. As mentioned, failure to upgrade will result in missed shows or unrecoverable hardware.

You can start by updating the Software and then Security Manager. As a reminder, the Security Manager requires a DLM, which is media block serial number specific. Once updated, ingest the Certificate Extension Package (serial number specific), which will extend the media block certificates after installation. Please note that we have created two types of Certificate Extension Packages, a bundle of 1,000 serial numbers and single serial number packages. Either of these will work as long as it targets the correct media block serial number. Grouping serial numbers makes it easier to distribute (the package size is larger), and for data restrictive scenarios, a single serial number package would be beneficial.

Note: When run, the Certificate Extension package is designed to validate the certificate directory files on the system before and after the certificate extension. Over the years, customers may have modified or renamed some of the certificate files on the system, which will cause an installation failure with the Certificate Extension packages. The system will provide a warning saying: Verifying certificates are update… [Failure]. If you experience this issue, use the package “dcp2000_ims_cleanup_cert-1.0.0.pkg” to clean up the certificate system files, then re-install the Certificate extension package. This package renames and re-orders the certificate files and does not change any other system function.

Please take a look at our knowledge articles.
Certificate Extension: https://kb.dolby.com/CinemaKnowledgeBas ... -Extension
Time Critical Issue: https://kb.dolby.com/CinemaKnowledgeBas ... K24-SM-RTC

[Carsten]

Oh wow. So, aside from the known cert expiration in late 2025, there is also a 'year 2024 problem'?

- Carsten