iLO4 update failed - Checking HP Secure Digital Signatur

[20cent13]

Hi All,

I tried to update iLO4 Firmware (1.22 to 1.30) with SPP2013090 but it's failed.

When i go to "iLO Firmware" tab, there is the following message : Checking HP Secure Digital Signature, please wait ...

Moreover, Remote Consoles didn't work since update (Java or Integrated Remote).

I tried to reset iLO4 with "hponcfg" command but i can't.

[root@XXX ]# hponcfg -r
HP Lights-Out Online Configuration utility
Version 4.3.0 Date 12/10/2013 (c) Hewlett-Packard Company, 2014
Firmware Revision = 1.22 Device type = iLO 4 Driver name = hpilo
Firmware flash is in progress.Please wait for a while.

is it possible to stop Firmware flash or reset to factory defaults ?

Server : HP DL360p G8

iLO4 : 1.22

OS: RHEL6.3 64

Could you please help me ?

Sorry for my english :-)

Regards,

Vincent

[scharchouf]

you update the firmware from iLO? under GUI Interface? 

[20cent13]

Hi Scharchouf,

Thanks for your return.

I updated firmware using SPP installation (./hpsum /force)

All RPM were successfully updated.

Please find in attachment deploy log.

------------------------------------------------------------

Startup session beginning: Fri Apr 25 11:13:53 2014
------------------------------------------------------------
Parameters given: -s

Online ROM Flash Engine: FLASH_iLO4 1.12 (Jan  6 2014)
Name:            ILOCZ231704C1
New Version:     1.40
Current Version:  1.22
Action:          upgrade

ERROR: Unable to start flash. [ilo4_140.bin]
------------------------------------------------------------
Session end
------------------------------------------------------------

Regards,

Vincent

[waaronb]

Try extracing the .bin file from the update package and then logon to the ILO web interface.  From there you can manually update the firmware using that bin file.

The latest ILO 4 firmware is 1.40, and the extracted BIN file name will be "ilo4_140.bin"

I have run into occasional issues where using the firmware update package or the command line utility failed to flash the firmware, but doing it manually through the web interface worked.  I'm not sure why, but it does seem to happen from time to time.

[20cent13]

Hi,

I can't do it manually through the web interface because it seems firmware flash is in progress (1%).

Buttons "Browse" and "Upload" are not available.

The following message displays : Checking HP Secure Digital Signature, please wait ...

Please find a screenshot in attchment.

Regards,

Vincent

[Jimmy Vance]

Click on the diagnostics tab and reset iLO

[20cent13]

Hi Jimmy,

Thanks for your return.

Unfortunately, reset iLO had no effect.

Following message always displays : Checking HP Secure Digital Signature, please wait ...

Do you know how to disable "Checking HP Secure Digital Signature" ?

Thanks for your help.

Regards,

Vincent

[Oscar A. Perez]

Could you please check in the iLO event log if iLO is actually rebooting when you press that button?  You should see a log entry mentioning something like iLO reset by diagnostics.  

The reason I ask is that If the firmware flash is in progress, you won't be able to reboot iLO from the diagnostic page.

[waaronb]

It seems like removing power from the server to force ILO to reset could be an option. Normally you wouldn't want to do that during any firmware update, but if it's been stuck on that status for a couple of weeks, I don't think it's actually flashing any firmware by this point.

[Torsten.]

Did you try firmware version 1.50?

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=5269386&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D%257CswItem%253DMTX_3a90128788264d4ea07b5752fb%257CswEnvOID%253D4138%257CitemLocale%253D%257CswLang%253D%257Cmode%253D5%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vi...

[Moderator edit: Removed the broken link. Please refer to https://support.hpe.com/]

[20cent13 · Accepted solution]

Hi,

My server has been unplugged for few minutes and iLO update has been reset.

New version (1.50) has been installed and eveything works fine now.

I'm closing this case.

Thanks for your help.

Regards,

Vincent

[waaronb]

Cool... and just in time to go out and download version 1.51 that became available a few days ago. :)

I think they fixed some SSL man-in-the-middle vulnerability...same patch they were updating in all their other stuff that uses SSL (VCRM, VCA, SMH, etc.)

[Maksim1]

Heloo. I have same issue with update ILO4 from 1.51 to 2.xx version. I try all metod to do it and all tame i have one problem i saw Checking HP Secure Digital Signatur and nothing come. What can be done to solve this problem?

[HPE-NEWBIE]

@Maksim1

I have the exact same issue.  Attempted update iLO4 from 1.51 to 2.55 but just it just stalls and displays the message: 

Checking HP Secure Digital Signature....

If I click on the Group Firmware Option I see the folowing status:

Group Firmware Update

Flashing Firmware Image, please wait ...

Group Firmware Update

1% Complete...

It says like this forever.

I have tried uploaing the iLO.bin file via the webinterface and also tried using the SPP (Service Pack for ProLiant Gen8.1)  and boot from a USB device.

Seems like nothin will work.

[RonenSh]

---

@HPE-NEWBIE wrote:

@Maksim1

I have the exact same issue.  Attempted update iLO4 from 1.51 to 2.55 but just it just stalls and displays the message: 

Checking HP Secure Digital Signature....

If I click on the Group Firmware Option I see the folowing status:

Group Firmware Update

Flashing Firmware Image, please wait ...

Group Firmware Update

1% Complete...

It says like this forever.

I have tried uploaing the iLO.bin file via the webinterface and also tried using the SPP (Service Pack for ProLiant Gen8.1)  and boot from a USB device.

Seems like nothin will work.

---

Hi, exactly the same problem with me...

Have you managed to solved that?

[AWarmke]

You can check the iLO 4 user guide, page 354 – http://www.hpe.com/info/ilo/docs. There is reference made to a similar issue that may be what you are experiencing.

[Protonus]

---

@RonenSh wrote:

---

@HPE-NEWBIE wrote:

@Maksim1

I have the exact same issue.  Attempted update iLO4 from 1.51 to 2.55 but just it just stalls and displays the message: 

Checking HP Secure Digital Signature....

If I click on the Group Firmware Option I see the folowing status:

Group Firmware Update

Flashing Firmware Image, please wait ...

Group Firmware Update

1% Complete...

It says like this forever.

I have tried uploaing the iLO.bin file via the webinterface and also tried using the SPP (Service Pack for ProLiant Gen8.1)  and boot from a USB device.

Seems like nothin will work.

---

Hi, exactly the same problem with me...

Have you managed to solved that?

---

I too, am having this issue, I've detailed it here and what I've tried so far: https://community.hpe.com/t5/ProLiant-Servers-ML-DL-SL/iLO-4-firmware-update-failure-stuck-on-quot-Checking-HP-Secure/m-p/7042085/highlight/false#M166311

Hate to bump an old thread, but did any of you figure out how to resolve this?  Unplugging hte server from power gets it out of the "trying to flash" state, but the very next flash it does the same thing...

[sangam_s]

Try updating newer version 2.62  April relase

https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_0605845b94a948e19846dd4301#tab-history

alternative option can be try to update ILO firmware from the Operating system.

based on the OS installed try updating from that.

https://support.hpe.com/hpesc/public/km/search#q=ilo4%20&t=DriversandSoftware&sort=relevancy&layout=table&f:@kmswsoftwaretypekey=[swt8000029]

refer troubleshooting advisory and see if it helps.

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00045315en_us&docLocale=en_US

[Torsten.]

Better try Ilo4 version 2.70:

https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_19a44e4d59044717833b3ddbb8#tab2

[Torsten.]

By the way - once I have seen strange things while my attempt to update using firefox browser, but using IE it finally worked.

[Protonus]

Welp, I'm at my wits end with this server. We tried power draining it again fully, then booted it up clean - verified that the iLO was in a normal state.

This time I pushed the bin file for intermediate version 2.10, up to the ESXi datastore directly, so the file was local. I then tried to do the firmware update via hponcfg using the Update_Firmware.xml script. While the script executed, it did eventually time out, because the iLO went right back to the "Checking HP Secure Digital Signature" status in the GUI, and it's once again stuck at 1% flash progress! This is the same thing that's happened every time we try and update this iLO, no matter the version or update method.

I think the iLO itself needs to be replaced. It's a ProLiant DL360p Gen8 - the iLO firwmare itself is on the motherboard, correct? Would this require a new motherboard to resolve?

[xrobau]

After doing some reverse engineering, this is an issue with the ANCIENT versions of ILO4. If the SYSTEM CLOCK is after 2015-ish, the certificate validation process will crash, and the upgrade process will hang at 1%.

The only way to fix this is to do a DIRECT FLASH. This means you need to turn the 'ILO Security' switch ON, and then boot the machine to Linux. Download the latest linux package. which is (at the time of writing) 2.81: https://downloads.hpe.com/pub/softlib2/software1/sc-linux-fw-ilo/p192122427/v213013/CP051872.scexe

Run 'bash CP051872.scexe --unpack=.' and then './flash_ilo4 --direct'

That disables all the verification and checks, and directly overwrites the ILO flash from the OS. I had to do that with a pair of BL460 G8's, and then I had to do a physical power cycle to remove the error light, but after that everything updated fine.