GDC TMS bug related to DolReMi certificate update patch

[Leo Enticknap]

A heads up for those of you with sites that have DCP2000, DCP-2K4, SV/IMB, IMS1000, and IMS2000 servers being operated via a GDC TMS. There is a bug whereby after you install the DCI certificate update patch on one of these servers, the TMS will stop recognizing KDMs as being for that media block, and list them as for "unknown screen."

image.png
I worked this with GDC, and thought it would be worth posting the fixes here in case anyone else encounters it.

There are two ways to resolve it. The first, if you do not want to update the TMS software for whatever reason, is as follows:

• Delete all affected KDMs from the theatre store
• Remove the affected players from the TMS library in server management
• Close the TMS, re-open and add them back in
• Map the servers to the POS auditoriums
• Re-ingest the KDMs

The second is to update the TMS software to version 4.3.14581 (available in the "pilot" folder of GDC's FTP site), having first deleted the "unknown screen" KDMs, and then reingest those KDMs afterwards.

[Steve Guttag]

Leo, all of the above is true if you change out a server (ANY) as the same condition arises...it doesn't know the new certificate. Delete off the old server...close the program (not just sign out), re-open and add (and fight with it to still open all serves upon boot up).

[Leo Enticknap]

I know that, but what is happening here is not changing out a server but, effectively, performing a software update on an existing one. The serial number never changes. It is therefore not self evident why a TMS fault would present after doing this.

My guess is that earlier versions of the TMS software downloaded the DCI certificate from the media block (via the server) once only, when it was configured and registered to the TMS, and thereafter used that certificate to check the validity of KDMs ingested into the TMS; and that in this new version, either it doesn't bother with the certificate at all (it just checks the serial number of the media block), or checks to see if it has been changed periodically, or if a KDM is ingested that it can't find a valid certificate for.

[Carsten Kurz]

It's weird though, that the updated server is not recognized. Yes, obviously something must have changed with the certificate with the cert extension update. But why then are existing KDMs that were issued and ingested before the update still valid after the cert extension update has been applied? Is that something the Doremis are able to sort out themselves after the update - e.g. accept 'old' and new KDMs, while, strictly, only new ones should be accepted? Not really important, but, I'd like to understand why the new cert validity doesn't render pre-existing KDMs invalid.

[Leo Enticknap]

This site only gets KDMs from Deluxe Technicolor, and they are very proactive about obtaining server certificates from the manufacturers. I suspect that Dolby likely supplied Deluxe with all the new certificates when they were generated, and would guess that the KDMs Deluxe issued from that point on contained both the old and the new ones for each media block. But there could be problems with mom-and-pop arthouse distributors who obtained the certificate package directly from a theater before the update patch was installed, though.