Ontap Update - Failed to verify the signatures of the image

[marcinmf]

I am upgrading FAS8020 dual controller switch less to the latest supported Ontap version 9.8.

I started with 9.1 and went to 9.3 (93_q_image.tgz ) with out problems. When tried to move to 9.5 95_q_image.tgz see this error message

Status of most recent operation:
Run Status: Exited
Exit Status: Failed
Phase: Unpack
Exit Message:
Failed to verify the signatures of the image. The image may have been corrupted.
Replace the image, and then try the command again.

Tried different image, the latest one from 9.3 - 93P21_q_image.tgz  no go. same problem.

Tried older image 93P5_q_image.tgz - that worked.

Tried something newer 93P18_q_image.tgz that fails.

Always the same message.

I have apache installed and service the files via http. I do not think apache is a problem because i was able to perform 2 upgrades. The Images are from netapp webpage so they must be good.

Is there a specific path for images to upgrade?

I tried 

93P5 to 93P21

93P5 to 93P18

93P5 to 95

93P5 to 95P16

I do not have any data so can delate everything and zedo drives. I just want to move to 9.8 what is the last supported one.

Any advice?

[AlexDawson]

Obvious question here but need to ask - have you verified the MD5/SHA sums against the ones posted on the download page?

Other questions: Exactly what version of ONTAP 9.1 was previously running on the system? Did it have an "X" in the version number? Does the system use encrypted drives and an external key manager?

If you have no data on the system, you can use option 7 "install new software first" the boot menu. Halt both nodes, special boot menu one node, then the other, then option 7, install from http on both nodes, then halt both, boot one to special boot, then option 9 - 9a - wipe one node, then when that's finished, run option 9a on the other too. When both are done, run option 9b on one node, then when it's finished, run it on the other, then it will reboot to ONTAP 9.8 cluster setup. These commands will of course remove all data and configuration from the system so should be done over a local serial connection.

[marcinmf]

Thank you for checking.

MD5 checked out. Used power shell and Get-FileHash.

I am not sure what was the version for 9.1. I was able to upgrade to 9.3 with out P, and to 9.3P5.

Currently my image1 is 9.3 and image 2 is 9.3P5 and is default on both controllers. 

I am using self encrypting drives. Encryption is not configured. Possibly this could be the problem. I will set it up with local key manager and try again.

I can also try from boot menu but did not tried that before. Do you know if this process is not verifying checksum? If not this could be the easiest for me. Just upload the 9.8 and let it install. Since i am not upgrading working system multi step upgrade is not needed - i believe.

[AlexDawson · Accepted solution]

If you're going to wipe it, doing it from the boot loader is the easiest step. It's a different verification process to the one inside ONTAP and avoids some of the BURTs which are the reasons behind my follow up questions. But in any case - you must return encrypting drives to unprotected mode before repartitioning or you may lose data in the future - https://docs.netapp.com/us-en/ontap/encryption-at-rest/return-seds-unprotected-mode-task.html 

[marcinmf]

I was able to get it installed. There was extra step in my case, had to remove disk ownership from option 5 before going to 9.

Found another article with all steps involved if anyone is looking for details.

https://community.netapp.com/t5/ONTAP-Discussions/Advanced-Drive-Partition/m-p/156323

I guess to do this with out disturbance additional set of controllers would be needed with switch and additional storage space to move data over. 

Thank you for the help!