Press CTRL+K to open search

Segura preventive maintenance procedure for on-prem environment

Next

What it is

Segura® is running the Robustness and Continuity Program across its customer base to make sure every environment's internal configuration is set correctly.

In some environments, we found that one of the internal communication certificates expires on September 30, 2026.

Segura® provides a preventive procedure script. The script checks the server it runs on and tells you whether the procedure is needed. If it is, the script runs the procedure automatically, verifies the result, and can reverse the changes.

The database isn't restarted and existing user sessions aren't interrupted. The script takes a backup before it changes anything, and it rolls back automatically if something fails.

Deadline

The procedure is simple, and you must complete it by September 30, 2026.

Impact on the system if you don't run it

If an environment doesn't finish the maintenance by the deadline, its services may be partly interrupted, degraded, or unavailable. The fix in that case is this same procedure, run after the impact instead of before. That's why we strongly recommend running it as a preventive step now.

How to run

This document section provides guidance on how to run the Segura® Platform maintenance script in the following configurations:

  • Standalone
  • Two-node cluster
  • Three-node cluster
  • Environments with Arbitrator
  • Offline environments

To check the status of your procedure, see the Check your results section.

Requirements

  • SSH session on the appliance with the administrative user and sudo permission.
  • All Segura® instances must have outbound access to repo.senhasegura.com over TCP port 443 (HTTPS). More information at Firewall rules for Segura® Platform.

Steps

Standalone

  1. Run the following command on the appliance:
$ curl -fsSL https://repo.senhasegura.com/settings/segura.sh | sudo sh
  1. Choose the language with the keyboard arrows and press Enter.
  2. Enter your company's name (the real name, as registered with Segura® support) and press Enter.
  3. Type SIM (or YES, in English) and press Enter to confirm.
  4. Wait for it to finish. The screen ends with Atualização concluída com sucesso (Update completed successfully).

Two-node cluster

Two Segura® instances in a cluster, without Arbitrator. The procedure has two stages: the first is run on each instance; the second only after the first has finished on all of them. Open an SSH session on each instance and keep both open until the end.

Stage 1 (perform this stage on each instance)

  1. Run the command on instance 1:
$ curl -fsSL https://repo.senhasegura.com/settings/segura.sh | sudo sh
  1. Choose the language with the keyboard arrows and press Enter.
  2. Enter your company's name (the real name, as registered with Segura® support) and press Enter.
  3. Type SIM (or YES, in English) and press Enter to confirm. The instance completes the first stage and stops at the waiting screen PRIMEIRA ETAPA CONCLUÍDA NESTE SERVIDOR. NÃO FECHE ESTA JANELA (FIRST STAGE COMPLETED ON THIS SERVER. DO NOT CLOSE THIS WINDOW).
  4. Leave that window open and repeat steps 1 through 4 on instance 2. Each one will stop at the same waiting screen.

Stage 2 (perform this stage on each instance)

  1. In instance 1's window, when asked A primeira etapa já terminou em todos os servidores? (Has the first stage finished on all servers?), type SIM (or YES) and press Enter.
  2. Type SIM (or YES) again to start the second stage and press Enter.
  3. Wait for it to finish. The screen ends with Atualização concluída com sucesso (Update completed successfully).
  4. Repeat steps 1 through 3 in the window of each of the other instances.
Attention

Stage 2 can only start after Stage 1 has finished on all instances. The utility itself warns about this: running it too early disconnects the server from the others. If a window is accidentally closed, run the same command again on that instance: the utility recognizes which stage it is in and asks whether the first stage has already finished on all servers.

Three-node cluster

Three Segura® instances in a cluster. The procedure has two stages: the first is run on each instance; the second only after the first has finished on all of them. Open an SSH session on each instance and keep all three open until the end.

Stage 1 (perform this stage on each instance)

  1. Run the command on instance 1:
$ curl -fsSL https://repo.senhasegura.com/settings/segura.sh | sudo sh
  1. Choose the language with the keyboard arrows and press Enter.
  2. Enter your company's name (the real name, as registered with Segura® support) and press Enter.
  3. Type SIM (or YES, in English) and press Enter to confirm. The instance completes the first stage and stops at the waiting screen PRIMEIRA ETAPA CONCLUÍDA NESTE SERVIDOR. NÃO FECHE ESTA JANELA (FIRST STAGE COMPLETED ON THIS SERVER. DO NOT CLOSE THIS WINDOW).
  4. Leave that window open and repeat steps 1 through 4 on instances 2 and 3. Each one will stop at the same waiting screen.

Stage 2 (perform this stage on each instance)

  1. In instance 1's window, when asked A primeira etapa já terminou em todos os servidores? (Has the first stage finished on all servers?), type SIM (or YES) and press Enter.
  2. Type SIM (or YES) again to start the second stage and press Enter.
  3. Wait for it to finish. The screen ends with Atualização concluída com sucesso (Update completed successfully).
  4. Repeat steps 1 through 3 in the window of each of the other instances.
Attention

Stage 2 can only start after Stage 1 has finished on all instances. The utility itself warns about this: running it too early disconnects the server from the others. If a window is accidentally closed, run the same command again on that instance: the utility recognizes which stage it is in and asks whether the first stage has already finished on all servers.

Environments with Arbitrator

Segura® environment in a cluster, with two or more instances and an Arbitrator server. The procedure is the same as the cluster procedure with the same number of instances, with an additional step on the Arbitrator at the end.

Stage 1 (on the cluster instances)

Follow the procedure in the Two-node cluster section (or the Three-node cluster section, as applicable) on all instances, up to the Atualização concluída com sucesso (Update completed successfully) message on each one. The warning about the Arbitrator server, shown in Step 8 of your terminal, is expected, since the additional step below resolves it.

More information about the Arbitrator at How to update the Arbitrator.

Stage 2 (Arbitrator)

  1. On instance 1 (primary), generate the new Arbitrator configuration with the command:
    1. $ sudo orbit cluster galera arbiter create-config.
      1. The files are located at /var/tmp/senhasegura-cluster-arbiter/.
      Info

      If the command returns an error, run $ sudo orbit cluster arbiter create-config instead. Note which one you ran, because step 5 uses the matching status command.

  2. Enable file copying and send the package to the Arbitrator server (replace USER and IP_ARBITRO):
    1. $ sudo orbit support scp allow
      1. In some versions, this command can return an error. If so, skip it and go to the next one.
    2. $ scp /var/tmp/senhasegura-cluster-arbiter/manifests.tar.gz USER@IP_ARBITRO:/tmp/
  3. On the Arbitrator server, stop the current containers and replace the configuration:
    1. $ cd /opt/manifests/docker-compose/ && sudo docker compose down
    2. $ cd /opt && sudo rm -rf manifests && sudo tar -xzvf /tmp/manifests.tar.gz
  4. Bring the containers back up and confirm they are running:
    1. $ cd /opt/manifests/docker-compose && sudo docker compose up -d
    2. $ sudo docker ps
  5. Back on instance 1, validate the Arbitrator connection and disable file copying:
    1. $ sudo orbit cluster galera arbiter status
      1. If you ran $ sudo orbit cluster arbiter create-config in step 1, run $ sudo orbit cluster arbiter status instead.
    2. $ sudo orbit support scp deny
      1. Skip this command if $ sudo orbit support scp allow returned an error in step 2.
Alert

If you still have trouble setting up the Arbitrator, open a support ticket and include the code SOP 140926.

Offline environments

For Segura® appliances without HTTPS outbound access to repo.senhasegura.com, the procedure is the same as for your topology; only the way the utility reaches the server changes — it is downloaded on a machine with internet access and transferred to the appliance. Steps 1 through 4 below replace the single command that opens the other sections; the execution itself remains that of your topology, with one or two stages depending on the environment.

How to identify

The standard command does not complete and ends with a curl message. The number varies depending on the block: (28) when the firewall drops the packets, after a few minutes of waiting, (7) when the connection is refused, and (6) when the name does not resolve. In all cases, nothing is changed on the server.

$ curl -fsSL https://repo.senhasegura.com/settings/segura.sh | sudo sh
curl: (28) Failed to connect to repo.senhasegura.com port 443 after 261702 ms: Couldn't connect to server

Steps

  1. On a machine with internet access, download the utility and the checksum file:
    1. $ curl -fsSL https://repo.senhasegura.com/settings/update-configurations -o update-configurations
    2. $ curl -fsSL https://repo.senhasegura.com/settings/SHA256SUMS -o SHA256SUMS
      Both addresses can also be opened in a browser. Download both one after the other: if the check in step 4 fails, download both again before contacting support.
  2. On the appliance, enable file copying and confirm by pressing y:
    1. $ sudo orbit support scp allow
  3. From the machine with internet access, send both files (replace USER and IP_APPLIANCE):
    1. $ scp update-configurations SHA256SUMS USER@IP_APPLIANCE:/home/USER/
  4. On the appliance, check the integrity and prepare the utility:
    1. $ cd /home/USER && sha256sum -c SHA256SUMS
    2. $ chmod +x update-configurations
      The check needs to return "update-configurations: OK". Any other response: do not run the file and contact Segura® support.
  5. Run the utility and follow the section for your topology starting from the Enter your company's name step:
    1. $ sudo ./update-configurations --lang pt-BR
    2. The --lang pt-BR option already selects Portuguese; without it, the utility asks for the language as in the standard command.
  6. At the end, disable file copying and confirm by pressing y:
    1. $ sudo orbit support scp deny
Attention

In a cluster. Steps 2 through 4 are done on each instance, before starting, and so is step 6. Stages 1 and 2 follow exactly the tab for your cluster, including the waiting screen between them.

Info
  • The screen may pause for a few seconds at the end. Without internet access, the utility takes a few extra seconds to finish after the last message. This is expected: wait, do not interrupt with Ctrl+C.
  • Arbitrator without internet: the command sudo orbit cluster galera arbiter create-config generates two files at /var/tmp/senhasegura-cluster-arbiter/: manifests.tar.gz, always required, and docker-images.tar.gz, with the container images. If the Arbitrator server already runs it today, it already has the images and only the manifests.tar.gz file is needed. On a new server, also transfer docker-images.tar.gz and load the images with sudo docker load -i docker-images.tar.gz before bringing up the containers.

Check your results

After running the command on the appliance, wait until the screen shows Atualização concluída com sucesso (Update completed successfully) and your procedure has finished successfully.

For the Standalone configuration: if the screen shows Este servidor faz parte de um cluster (This server is part of a cluster), press Enter to cancel and use the corresponding cluster tab.

For offline environments, wait until the screen shows Atualização concluída com sucesso (Update completed successfully) according to your topology.

Otherwise, do not restart anything and open a support ticket to Segura® with the full terminal output and include the code SOP 140926.

Digital sovereignty is a fundamental right for citizens, institutions, and society. That’s why we work every day.
Connect With Us
SEGURA
LEARN
EXPLORE
Copyright © Segura. All Rights Reserved