Skip to main content

Verify the ONTAP Mediator code signature

Contributors netapp-sarajane netapp-thomi netapp-ranuk netapp-dbagwell
PDFs

NetApp recommends verifying the ONTAP Mediator code signature before installation. This step is optional.

Before you begin

Make sure your system meets these needs before verifying the ONTAP Mediator code signature.

Note

  • From June 15th, 2025, you can't install or upgrade to ONTAP Mediator 1.9 and 1.8 because the code signature verification certificates have expired. Instead, install or upgrade to ONTAP Mediator 1.11 or 1.10.

  • If the system doesn't meet the below requirements, the verification process isn't required and you can go directly to Install the ONTAP Mediator installation package.

  • openssl versions 1.0.2 to 3.0 for basic verification

  • openssl version 1.1.0 or later for Time Stamping Authority (TSA) operations

  • Public internet access for OCSP verification

The download package includes the following files:

File

Description

ONTAP-Mediator-production.pub

The public key used to verify the signature

csc-prod-chain-ONTAP-Mediator.pem

The public certification CA chain of trust

csc-prod-ONTAP-Mediator.pem

The certificate used to generate the key

ontap-mediator-1.11.0

The product installation executable for version 1.11

ontap-mediator-1.11.0.sig

The SHA-256 hashed, then RSA-signed using the csc-prod key, signature for the installer

ontap-mediator-1.11.0.sig.tsr

The revocation request for use by OCSCP for the installer’s signature

ontap-mediator-1.11.0.tsr

The timestamp signing request file

tsa-prod-ONTAP-Mediator.pem

The public certificate for the TSR

tsa-prod-chain-ONTAP-Mediator.pem

The public certificate CA Chain for the TSR
Steps

  1. Perform the revocation check on csc-prod-ONTAP-Mediator.pem by using Online Certificate Status Protocol (OCSP).

    1. Find the OCSP URL for the certificate. Developer certificates might not provide a URI:

      openssl x509 -noout -ocsp_uri -in csc-prod-chain-ONTAP-Mediator.pem

    2. Generate an OCSP request for the certificate.

      openssl ocsp -issuer csc-prod-chain-ONTAP-Mediator.pem -CAfile csc-prod-chain-ONTAP-Mediator.pem -cert csc-prod-ONTAP-Mediator.pem  -reqout req.der

    3. Connect to the OCSP Manager to send the OCSP request:

      openssl ocsp -issuer csc-prod-chain-ONTAP-Mediator.pem -CAfile csc-prod-chain-ONTAP-Mediator.pem -cert csc-prod-ONTAP-Mediator.pem  -url ${ocsp_uri} -resp_text -respout resp.der -verify_other csc-prod-chain-ONTAP-Mediator.pem

  2. Verify the trust chain of the CSC and expiration dates against the local host:

    openssl verify

    Note The openssl version from the PATH must have a valid cert.pem (not self-signed). 
    openssl verify -untrusted csc-prod-chain-ONTAP-Mediator.pem -CApath ${OPENSSLDIR} csc-prod-ONTAP-Mediator.pem  # Failure action: The Code-Signature-Check certificate has expired or is invalid. Download a newer version of the ONTAP Mediator.
openssl verify -untrusted tsa-prod-chain-ONTAP-Mediator.pem -CApath ${OPENSSLDIR} tsa-prod-ONTAP-Mediator.pem  # Failure action: The Time-Stamp certificate has expired or is invalid. Download a newer version of the ONTAP Mediator.

  3. Verify the ontap-mediator-1.11.0.sig.tsr and ontap-mediator-1.11.0.tsr files using the associated certificates:

    OpenSSL 3.x

    openssl ts -verify -data ontap-mediator-1.11.0.sig -in ontap-mediator-1.11.0.sig.tsr -CAfile tsa-prod-chain-ONTAP-Mediator.pem -untrusted tsa-prod-ONTAP-Mediator.pem

    OpenSSL 1.x

    openssl ts -verify -data ontap-mediator-1.11.0 -in ontap-mediator-1.11.0.tsr -CAfile tsa-prod-chain-ONTAP-Mediator.pem -partial_chain

    Note .tsr files contain the time stamp response associated with the installer and the code signature. Processing confirms that the time stamp has a valid signature from TSA and that your input file has not changed. Your machine performs the verification locally. You do not need to access TSA servers.

  4. Verify signatures against the key:

    openssl -dgst -verify

    openssl dgst -sha256 -verify ONTAP-Mediator-production.pub -signature ontap-mediator-1.11.0.sig ontap-mediator-1.11.0