Sage Alerting Systems
Digital ENDEC model 3644
Firmware Revision: Alert Authentication Certificate Update cr-rev4
Released May 29, 2018
Release notes for certificate update cr-rev4 Ė for United States ENDECs only
This release updates CAP alert authentication certificates that are needed to continue to receive CAP alerts from IPAWS and some other CAP alert providers.† This update must be installed by 11:45am EDT on June 24, 2018.† The release also contains root certificates used for HTTPS access to web sites that provide alert audio files.
This release is only to be applied to ENDECs that already have version 89-30 installed.
Do not install this release on ENDECs in Canada.
As always, the detailed instructions are far more complex than the actual steps you need to take.† Weíve split this release note into two parts, one simplified, and one details.† The simple version is first.† It assumes that you know how to access your ENDECís web page.† There are four steps.
Step 1.† Verify that your ENDEC is up to date, and is ready for this update.† Check your version by clicking the version button on the ENDECís web page.† If you see version 89.30 as shown below, continue to step two, otherwise see the details section.
Step 2.† Check to see if your ENDEC already has the cr-rev4 update.† Find the CR rev as shown below.† If it has CR rev 2, you need to install this update.† If it already has CR rev 4, you do not need this update.
Step 3. Since you have 89-30, and CR rev 2, you need to install the update.† Download it from the sage web site here: †† https://www.sagealertingsystems.com/release1-1/cr-rev4.x†and then upload it to your ENDEC with the Upload Firmware button on the ENDECís web page.
Step 4.† Once the ENDEC has rebooted (you will need to manually refresh the web page after about two minutes), click the version button again.† Check to make sure you now have CR rev 4, as shown below.
Read this section only if you want more details, or your version was not 89.30.
Here are the steps you must follow to install this release.
Step 1.†† Before installing this release, use the version button on the ENDECís home page and check this line:
Board rev x/nn.mm
nn (major version) must be 89, mm (minor version) must be 30.† If you have 89.30, skip to the next step.
If you have a major version less than 89, you must first install version 89.† If you have a major version 89 but a minor version less than 30, you must install 89-30 before installing the cr-rev 4 update.† Read the 89-30 release notes at https://www.sagealertingsystems.com/support-firmware-89-30.htm for details. †
Note that the ENDEC uses a major.minor release identification system.† The ď.Ē is a separator, not a decimal point.† The ENDEC will show you a version number like this: 89.30, meaning major release 89, sub release 30.† A displayed version of 89.6 is a major release of 89, and a minor release of 6.† As 6 is less than 30, the 89.6 version is older than 89.30, and your ENDEC should be updated before continuing this procedure.
If you have a major release number of 90 or 91, see the section on special releases below.
Step 2.†† From the information on the version page you obtained above, look at the last line.† You will see a list of feature codes, for example:
CR rev 2, CA rev 2, SEC rev 2
If your CR rev is less than 4, as shown above, then you need to install this release and should continue to step 3.† If you have version 89-30 and the feature code line shows CR rev 4, your ENDEC has already been updated and you do not need to install this release.
If you do not see a line of feature codes, refer to step 1.
Step 3.†† Download the firmware update file from here:
†††††††††††††† Save the file to your desktop or another convenient location.
Step 4.†† Install this release by using the Upload Firmware button on the ENDECís home page. Upload the cr-rev4.x file you downloaded in the above step.
Step 5.†† After the reboot, use the version button on the ENDECís home page and check for this line:
CA rev 3, CR rev 4, SEC rev 4, VTAG
Note that the browser wonít refresh on its own, youíll need to click the home button on the ENDECís web page once it has rebooted.† If you do not see that line, the update did not install.† Check to see that you have performed the above steps, then contact us at firstname.lastname@example.org, or call us at 914-872-4068 Ė press 1 for support.
IPAWS intermediate certificates
These security certificates allow the ENDEC to use the digital signature in the CAP message to verify that the message came from an authorized authority, and that it wasnít changed between the originator and the ENDEC.† These certificates expire periodically.
FEMA currently uses a chain of 5 certificates for alert validation, one of which expires at Jun 24 15:45:07 2018 UTC.† This release will update that certificate.
FEMA plans to decrease the amount of time that certificates are valid.† Sage will switch from its current static intermediates scheme to dynamic acquisition of intermediates in the near future.
Root certificate bundle
These are security certificates are used to allow the ENDEC to access web sites using HTTPS.† Some alert originators use HTTPS links to audio files in their CAP alerts. The ENDEC must be updated periodically to allow access to websites using newer certificate authorities.† New root certificates are issued at a slow rate, and web servers typically include the chain of intermediates during the connection process.† Sage will continue to use static distribution of root certificates.
There were two non-standard releases issued in the past, version 90 and version 91.† Neither of those versions meets the 2016 FCC National Periodic Test and national location code requirements. The special features of those versions are included in the standard 89-30 release.† If you have major version 90 or 91, you should have already uploaded version 89-30 - see the version 89-30 information page at https://www.sagealertingsystems.com/support-firmware-89-30.htm and refer to step 1, above.
Some users in Missouri received an early version of the root bundle update.† It shows as ďCA rev 3Ē on the version page.† This CR rev 4 update also includes CA Rev 3.† If you have not already installed CA rev 3, you do not need to do so now, just install this CR rev 4 update.