VNX2: VNX2 Series Operating Environment upgrade procedures to SHA-2 signed version 05.33.009.5.236 or later, including how to recover from any errors (Dell Correctable)

VNX2 builds environment uses an SHA-1 certificate and a change to an SHA-2 signed certificate is needed.

VNX1 continues to be SHA-1 signed.
 

The OE versions before 05.33.009.5.236 on the SP do not support SHA-2 signed drivers. As a result, a hotfix must be installed before installing 05.33.009.5.236 and later bundles. Otherwise, the upgrade does not complete.

The upgrade Process to VNX2 OE version 05.33.009.5.236 or later depends upon the starting revision.

An upgrade from any release that is NOT 05.33.009.5.155 requires a one-time two-step process.

If the upgrade is from 05.33.009.5.155, then a one-time three-step process may be necessary.

Two-step process when starting revision is not 05.33.009.5.155:

1. NDU the SHA-2 support package that is must install the SHA-2 hotfix.
   Note: This causes normal NDU SP reboots.

2. After the SHA-2 support package has been installed, the VNX2 OE 05.33.009.5.236 or later bundle can be installed following standard VNX2 OE upgrade procedures.

Notes:

• There are no changes to the process for upgrading the File OE. For any VNX2 File or Unified system, first upgrade the File OE then follow the required steps in this KB for the Block OE upgrade.

• Installing the SHA-2 support package is a one-time operation.

• Upgrading a VNX2 to 05.33.009.5.236 and later packages REQUIRES the SHA-2 support package be installed. Otherwise, the upgrade does not complete.

Three-step process when starting revision is 05.33.009.5.155: 

Upgrading VNX2 05.33.009.5.155 to 05.33.009.5.236 or later may require a one-time, three-step process.

1. It requires KB488877-01.01.5.001-armada64_free.ndu package be installed first (if not already installed) in order to perform the upgrades without any I/O delays. 
   Use naviseccli ndu -list or Unisphere UI and check to see if the KB488877 package is installed.
   See information below under 'Additional Info'.

2. NDU the SHA-2 support package, which applies the hotfixes to support SHA-2. 
   Note: This causes normal NDU SP reboots.

3. After the SHA-2 support package has been installed, the VNX2 OE 05.33.009.5.236 or later bundle can be installed following standard VNX2 OE upgrade procedures.

• There are no changes to the process for upgrading the File OE. For any VNX2 File or Unified system, first upgrade the File OE then follow the required steps in this KB for the Block OE upgrade.

• Installing the SHA-2 support package is a one-time operation.

• Upgrading a VNX2 to 05.33.009.5.236 and later packages REQUIRES the SHA-2 support package be installed. Otherwise, the upgrade does not complete.

• See KB article 488877: VNX: Data unavailable during a controlled reboot when running OE for BLOCK Rel 33 P155 (User Correctable) for more details and the needed KB488877-01.01.5.001-armada64_free.ndu package.

Using CLI to verify the existence of the SHA-2 Support package:  

Using Unisphere to verify the existence of the SHA-2 Support package:  

If the Procedure does not complete with following error examples, follow the above Resolution.

NDU does not complete without SHA-2 Support Package CLI:  

NDU does not complete without SHA-2 Support Package USM:  

Using cli to verify the existence of the KB488877 package if array is running 05.33.009.5.155:
If KB488877 package is not installed, then it must be installed in the first step of the three-step process.

Example of cli command showing KB48877 is installed:
If KB488877 exists, then start with step 2 of the three-step process.

        

Using Unisphere to verify the existence of the KB488877 package if array is running 05.33.009.5.155:  
If KB488877 package is not installed, it must be installed in the first step of the three-step process.