Action Needed: Update cnMaestro On-Premises Root CA Before Upgrade
Overview
A root CA certificate used for validating cnMaestro On-Premises OVA and package upgrades has expired. This may prevent upgrades from older cnMaestro On-Premises deployments because the upgrade package signature verification can fail.
To resolve this, Cambium Networks has provided a root CA update script. Customers must run the one-line command below on the existing cnMaestro On-Premises deployment before performing the upgrade.
Issue
The root CA certificate embedded in previously shipped cnMaestro On-Premises OVAs expired on April 17, 2026.
Because this certificate is used during upgrade validation, customers running older deployments may see upgrade failures when applying newer OVAs or packages.
Error Seen During Upgrade
If the root CA certificate is not updated before the upgrade, customers may see the following error during package or OVA validation:
ops.image.cnmaestro-extract - ERROR - CODE-1000: Package signature verification failed
This error indicates that the package signature validation failed because the existing deployment does not have the updated root CA certificate required to verify the latest repackaged OVA or upgrade package.
Impact
Customers may be unable to upgrade cnMaestro On-Premises until the root CA certificate is updated on the existing deployment.
This issue affects upgrade validation only. The required action is to update the root CA certificate before starting the upgrade.
Resolution
Cambium Networks has generated a new root CA certificate with an extended validity period.
All cnMaestro On-Premises OVAs from version 3.2.0 onwards and the corresponding upgrade packages have been repackaged and signed with the new root CA. Updated OVAs and packages are available from the Cambium Networks support site.
Before upgrading to cnMaestro On-Premises version 3.2.0 or later, customers must run the following command on their existing cnMaestro On-Premises deployment.
Required Action Before Upgrade
Copy and run the below command on the existing cnMaestro On-Premises deployment:
curl -fsSL https://registry.cloud.cambiumnetworks.com/repository/raw-hosted/cnmaestro/ova/validation/update_cnmaestro_root_ca.sh | sudo bash
This command updates the root CA certificate required for validating the latest cnMaestro On-Premises OVA and upgrade packages.
Upgrade Steps
-
Log in to the existing cnMaestro On-Premises server cli.
-
Run the root CA update command:
curl -fsSL https://registry.cloud.cambiumnetworks.com/repository/raw-hosted/cnmaestro/ova/validation/update_cnmaestro_root_ca.sh | sudo bash -
Download the latest cnMaestro On-Premises OVA or upgrade package from the Cambium Networks support site.
-
Perform the upgrade as usual.
-
The upgrade package signature validation should now complete successfully.
Important Note
The root CA update command must be executed before upgrading from an older cnMaestro On-Premises deployment. Once the root CA is updated, future upgrade validation will use the updated certificate.
If the following error was already seen during an attempted upgrade, run the root CA update command and then retry the upgrade:
ops.image.cnmaestro-extract - ERROR - CODE-1000: Package signature verification failed
Support
If the upgrade still fails after running the root CA update command, please contact Cambium Networks Support with the upgrade logs and the cnMaestro On-Premises version currently installed.