Domino on Linux/Unix, Troubleshooting, Best Practices, Tips and more ...

Notes Client FP Installs fail starting 20.4.2018

Daniel Nashed  24 April 2018 09:38:04
Since 20.4.2018 Notes Client Feature Pack Installations are failing.
I got the first report on Friday and another customer pinged me on Monday.

And we are discussing among partners about this issue.


One partner reported that updates from FP9 to FP10 still work for him. But all other updates are failing.

IBM state that this isn't an issue with FP7 or FP8. But I have not verified that.


The root cause is that signatures for some plug-ins cannot be verified any more because the certificate validation expired.

It's not just one plug-in that fails and you might have a different plug-in that is reported to cause the error.


Here is the error message that you see n the Eclipse logs:


java.security.cert.CertificateExpiredException: NotAfter: Fri Apr 20 01:59:59 CEST 2018


If you turn back the time to an earlier date it's still works. But this isn't a work-around I would suggest.


There is another work-around to temporary allow expired certificates of signatures during install and enable it afterwards.


You would need to add the following setting to plugin_customization.ini and revert the setting back after installation.


"com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=ALLOW"


But again this is also just a work-around.


IBM is aware of the issue and posted a technote -> http://www.ibm.com/support/docview.wss?uid=swg22015805

They are working on a solution. The technote says that they don't know exactly what is causing the issue. We have to wait for their update.

And I would recommend to wait before updating your clients until a fix is available instead using the work-arounds.



Update April 26, 2018:

IBM/HCL posted an update today in the TN. They found the issue, fixed it and hopefully if QE testing is successful we will have a fix soon.

@Marc, see they are posting an update for 9.0.1 FP9, FP10, Current MAC 64bit Client and also 8.5.3 FP6!
So the update for FP9 will be first and the other versions follow soon!



Here are the details from the update:

We have found a solution for the certificate issue for all products and versions. Please see the eGA for each product and version in the table below. Please note this is subject to change depending on the outcome of our QE Testing.
Product Version                                  Projected eGA
Notes Client 853FP6IF16                    Tuesday May 1, 2018
Notes Client 901FP9IF2                 Friday April 27, 2018
Notes Client 901FP10IF3                 Beginning of May 2018
MAC 64-bit IF15                         Tuesday May 1, 2018
Sametime Standalone 9.0.1 FP1         Beginning of May 2018



-- Daniel

Comments

1Rene Thorarinsson  24.04.2018 10:56:13  Notes Client FP Installs fail starting 20.4.2018

Hi Daniel.

Thanks a lot for this post..

2Koen de Leijer  24.04.2018 12:31:47  Notes Client FP Installs fail starting 20.4.2018

Hi Daniel

Many thanks for the workarounds,

we've been succesfull with plugin_customization.ini and FP9

Regards

Koen de Leijer

3Mathias  24.04.2018 13:48:40  Notes Client FP Installs fail starting 20.4.2018

Hi Daniel,

we also faced this problem with FP9 SHF55 and FP SHF68. In addition we have problem whith the calendar.

All views excepting "weekly planner" were greyed out after starting the client using the workaround with the plugin_customization.ini.

IBM have opened SPR # PAULAY5CTW and APAR LO93931 for this.

Only switching the date in the os before installing the notesclient help us to solve both issues.

Hoping for a quick fix for this problems.

Regards

Mathias

4thorsten ebers  24.04.2018 18:10:20  Notes Client FP Installs fail starting 20.4.2018

I decided exactly to update my notes client to fp10if3 from 7 exactly 20th april.. wasted whole weekend trying to get to fp10... nnow i know whats going on :-)

5Marc Thomas  24.04.2018 23:05:58  Notes Client FP Installs fail starting 20.4.2018

I tried several workarounds regarding that issue. All of them are not recommended to use them in a regular deployment.

But another question is how IBM will try to fix this. From my point for view repackaging is inevitable.

There are still enough reasons for customers not to deploy FP10. At least my own advise is not to use FP10 in many cases.

My fear is that IBM will only provide something like FP10 IF3 but a FP9 IF 2 is unlikely.

Due to that situation, probably every customer has to deploy FP10 IF.X if they want to use any modern FIX/Feature Level.

This will leads to new interesting situations on cutomer site

So lets see how IBM will deal with this situation.

-Marc

6Libor Dlouhy  25.04.2018 6:40:36  Notes Client FP Installs fail starting 20.4.2018

IBM Sametime Standard client - the same problem.

Workaround in plugin_customization.ini:

com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=ALLOW

com.ibm.rcp.security.update/UNSIGNED_PLUGIN_POLICY=ALLOW

com.ibm.rcp.security.update/UNTRUSTED_SIGNATURE_POLICY=ALLOW

7Lars Berntrop-Bos  25.04.2018 8:46:29  Notes Client FP Installs fail starting 20.4.2018

>revert the setting back after installation

Since the plugin_customization.ini in the Fix pack installer directory 'deploy' needs to be changed, i don't see the need for reverting it.

What would be the objection to letting the fix stay in 'plugin_customization.ini' and reusing the extracted installer as needed?

8Lars Berntrop-Bos  25.04.2018 9:06:21  Notes Client FP Installs fail starting 20.4.2018

@ Mathias: Given that 'plugin_customization.ini' needs to be fixed in the installer, why would you apply the fix to 'plugin_customization.ini' in the client?

Could you test applying the fix to the installer 'plugin_customization.ini' and not the client to see if that fixes your problem and report the result?

9Radu  25.04.2018 9:07:26  Notes Client FP Installs fail starting 20.4.2018

Anybody having issues with Notes updates for MacOS? Got already several Macs with problems after updating Notes 64bit for Mac to IF14 and Java 8u171.

Just as in this older technote { Link } , When launching Lotus Notes Standard, the splash screen displays, after entering password, "Lotus Notes is starting, please wait..." briefly displays and then closes. Lotus Notes never loads.

Managed to get Notes working only in basic mode, so it's definitely something related to Java/Eclipse.

Uninstalled and reinstalled Notes, uninstalled and installed older versions of Java (like Java 8u151), older IF's. Simply nothing. Seems like corrupted libraries

10Lars Berntrop-Bos  25.04.2018 9:12:22  Notes Client FP Installs fail starting 20.4.2018

Aha spoted that the technote recommend removing the lines form the file *used by the fipack installer only*.

I fail to see what impact that would have on subsequent running of the client. Also in the technote is readoning that states that fiddling with the date is not so bad since the client is not started. But if you watch the fix pack installer running with Process Explorer, you see that part of the install is done with a notes executable.

It *should* all be fine, but... accidents do happen.

I'm a lot more comfortable with a couple of lines in an ini file in the fixpack installer than changing the date.

11Lukas  25.04.2018 9:31:24  Notes Client FP Installs fail starting 20.4.2018

@Radu

Same issue here, with IF13 and IF14 for Mac.

Set the Systemtime to a past date, and install it again.

So it seems that IF13 and IF14 are also affected on Mac!

12Radu  25.04.2018 9:47:45  Notes Client FP Installs fail starting 20.4.2018

@Lukas

Thanks Lukas. Will definitely give it a try today and see if it will work.

13Marc Thomas  25.04.2018 10:38:47  Notes Client FP Installs fail starting 20.4.2018

I prefer changing the date instead changing the plugin_customization.ini.

You can do it within the same execution string of the FP.

e.G.: set truedate=%date% & date 04/18/18 & 901FP9SHF55_W32_standard.exe -s -a /s /v"/qb-" & date %truedate%

In this case no changes are need in the download package. Otherwise you need to unpack the installer, change the plugin_customization.in and revert the changes on Client site after a successful installation. (and assure its done)

From that point of view you have potential more failure points.

But in generell it is choosing between two worse alternatives.

Closing this with an Star Trek Discovery Episode Tittle: "Choose your pain!" :-)

14Mathias  25.04.2018 12:52:00  Notes Client FP Installs fail starting 20.4.2018

@ Lars. thanks for your input. I checked that an it worked.

I set the "com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=ALLOW" in the plugin_customization.in of the notes client installation and fp10 installation package

Client is starting and also no calendar issue

In addition I have got a feedback of IBM that a fix will be available in the next 2 - 3 days

15Jay Marme  25.04.2018 19:29:27  Notes Client FP Installs fail starting 20.4.2018

Since the folder that the installer unpacks to is not part of the Windows path, and is also not within the data directory that Notes is using, I am questioning why it would be necessary to remove the "com.ibm.rcp.security.update/EXPIRED_SIGNATURE_POLICY=ALLOW" from the install package's plugin_customization.ini before starting the Notes client. The desktop team have run several installs without removing the line, and have not encountered any issues when launching the Notes client. They confirmed that the line was not added to any of the plugin_customization.ini's found within subfolders of the framework folder or the osgi folder.

16Marc Thomas  25.04.2018 21:44:27  Notes Client FP Installs fail starting 20.4.2018

@Jay:

If you change/add the "/EXPIRED_SIGNATURE_POLICY to "ALLOW" in the "FP" package it will rollover the plugin_customization.ini within the Notes Program Directory (framework\rcp). Please validate that! So without removing / changing the /EXPIRED_SIGNATURE_POLICY there means, at this time any expired certificates will be accepted by Eclipse.The reason why IBM support recommends to remove / revert that file (at the Program Directory) relate to weakening the client security and not due to side effects or issues during runtime. Just saying. :-)

17Marc Thomas  26.04.2018 20:54:49  Notes Client FP Installs fail starting 20.4.2018

The IBM just updated the Support doc.

It is reassuring that IBM will provide updated versions ob FP9, too.

Probable release Dates:

Product Version Projected eGA

Notes Client 853FP6IF16 Tuesday May 1, 2018

Notes Client 901FP9IF2 Friday April 27, 2018

Notes Client 901FP10IF3 Beginning of May 2018

MAC 64-bit IF15 Tuesday May 1, 2018

Sametime Standalone 9.0.1 FP1 Beginning of May 2018

18Daniel Nashed  27.04.2018 1:08:27  Notes Client FP Installs fail starting 20.4.2018

IBM/HCL Posted an update today! They have a fix which is currently tested and is available soon.

See my updated post.

-- Daniel

19Marc Thomas  30.04.2018 12:45:39  Notes Client FP Installs fail starting 20.4.2018

@Daniel: Right! I was becalmed when i read this in the Support Doc! Also the fix for 8.5.3 was unexpectedly but good to see! :-) I tested the available fixes,... and so far they worked well. .. :-)

20Marc Thomas  01.05.2018 11:35:15  Notes Client FP Installs fail starting 20.4.2018

@All: The whole IF´s are available. I have tested all but 8.5.3 and Sametime. It seems working. As a goodie, the blemish unsigned notes2.exe is corrected in FP10 IF3.

Fix introduced in release SPR Description Additional Information

Notes 9.0.1 Feature Pack 10 Interim Fix 3

Help > About shows 9.0.1FP10 SHF81

JAMEAX2KGC Fix an issue where the mail archive search bar is not displaying

PCMAAXZNQB Resolved Notes or embedded Sametime installation fails with error XCHARXCwpst1002w: Signature Has ExpiredXCHARX

RMAAAY5659 Fix an unsigned notes2.exe

21Jeff  23.05.2018 1:14:52  Notes Client FP Installs fail starting 20.4.2018

@Daniel - thanks for posting this. Just came in handy.

Archives


  • [IBM Lotus Domino]
  • [Domino on Linux]
  • [Nash!Com]
  • [Daniel Nashed]