Dolby to issue a patch to extend media block public certificates beyond November 2025

[Leo Enticknap]

I received a document today (Dolby Technical Bulletin # 135) stating that Dolby is working on a field or remote installable patch that will extend the public key certificates of media blocks that expire in November 2025. It will available at no cost. This affects both variants of Dolphin media block, the Doremi IMB, IMS1000, and IMS2000. The DSP100, cat862, cat745, IMS3000, and CAT1600 (Atmos media block in the CP850) are not affected, because they have longer lasting certificates.

They have not finished creating the patch yet, and will release it when they have. When that happens, it's important to apply it before the existing certificates expire, because it can't be afterwards. Obviously this is four and a half years out, but we'll need to keep it on our radars. I would be very surprised if I'm looking after any Dolphins or IMS1000s still in service by then, but there will likely still be Doremi IMBs and IMS2000s.

The bulleetin itself has a copyright notice in the footer, so I don't feel comfortable attaching it here, but this is the gist of it.

[Sam Chavez]

Dolby's always been a class act after the sale and didn't and don't sweat the small stuff. Bet this puts some pressure on the others and they know who they are for being chicken shit.

[Carsten Kurz]

You mean we should be grateful that the IMS2000 we bought last year won't be expiring artificially already in 2025, after we paid a technician to patch it?

[Leo Enticknap]

I'm hoping that the patch will be straightforward enough that a reasonably competent end user should be able to install it. That having been said, doing anything that involves messing with a media block does carry a certain degree of risk; as against which, they are giving us enough lead time that it should be possible for a tech to take care of it during a scheduled planned maintenance visit, at no or very little extra cost.

As Sam points out, Dolby has said that it will issue the patches for free, even for units that are many years out of warranty. There is another manufacturer, whose older media blocks expire around now. The last I knew (last September was the last time I had to have one recertificated), they will only renew them if you reactivate the server's warranty, at significant cost (though to be fair, they were also offering a significant trade-in discount if you upgraded the affected server to a newer model). Dolby is offering a big improvement on that arrangement.

[Carsten Kurz]

Nothing compared to Barcos policy to reserialise a brain-dead ICMP for the full price of a hardware replacement ;-)

[Steve Guttag]

I suspect that Dolby realizes that this train wreck was their doing (short certificate times), or at least the company they acquired's doing (Doremi). As such, they are going to do what they can to preemptively rectify the situation. Brand "G" servers have yielded 10-years and their re-certification costs have been "reasonable" and pretty straight forward and have included a software update to relieve the user of the "nag" for another year. The CAT862 has a very long certificate life (as does the life of CAT862 itself). As for Barco...their factory warranty has always been a bit too short though their extended warranty has gotten better over the years and adding an ICMP to a projector's warranty is easy (and reasonably priced) enough. Then again, after 10-years, when the extended warranty option evaporates, they make it almost cost prohibitive to service the old projector, depending on what fails and, as per Carsten's statement above, the same would be true of the ICMP. As Sam pointed out, Dolby has never been "that way" about their support.

I really take this as Dolby seeing a train wreck in 4-years and is heading it off now and, for sure 2-years before the derailment.

[Sam Chavez]

Who in the cinema business thinks more than six months ahead? If they did half of us would not have jobs. Barco with a $22,000 refurbished light engine and a 90 day warranty is a peeve of mine. Might be strategic but damned pricey for such a chintzy warranty.

[Marcel Birgelen]

The problem with all kinds of root and intermediate certificates of having them last longer than 10 years is that all kinds of client libraries won't validate those certificates. I've dealt with this kind of stuff myself... While it's often easy to fix if you control all the source code, when you're dependent on third party pre-compiled modules, you often have no other choice than to commit to those limitations. Still, those certificates are just one of the many frustrating things in modern-day technology. It's one thing if you're facing some hardware defect, but facing a bricked piece of equipment, just because a date doesn't match up makes me pretty angry...

[Carsten Kurz]

It's strange that even Doremi->Dolby products like the IMS2000, that was still sold last year, has an expiration date of late 2025. Is it possible that they missed that aspect of the Doremi dolphin design for so long? All these device certs still reference 'dolphin'. I can understand Doremi chose that timeframe for the original dolphin board back in 2007. But why didn't they update it with later boards, the IMB, IMS, etc.?

[Marcel Birgelen]

Where is your imagination? Well, then, let me use my limited skills to tell you the story of the expiring certificate...

Episode 1: No New Hope

Nobody really noticed something dark was brewing...
...or the dude/dudette that noticed told the dudes or dudettes that should know better about it, but they decided to do the normal procrastination-game...

"It's due in what? 5 years? Heck, we'll check it next year...
...maybe?"

Then there was this other dude/dudette, who actually wanted to solve it before impending doom would strike, but he/she couldn't find the documentation of how to actually enroll a new certificate. He/She asked Frank, Carolyn, Pete, Lisa and John about it, but they also didn't know.

"Well, we still got 5 years. Let's solve tomorrow's problems tomorrow!"

<<Roll Credits>>

I should put some variables in there. That way, you can apply it to whatever random problem crops up, small stuff like finally installing the toilet paper holder and somewhat bigger stuff, like climate change.

[Steve Guttag]

I suspect that a problem with the UI design of the Doremi/IMS system, despite having gobs of information, I don't think the certificate expiration is one of them. If it was more in your face and changed color (or sent up a warning flag), it might get more attention and this would be caught sooner. I'd think anyone that put in an IMS2000 within the past 5-years would have asked "what gives" with the short certificate period?

[Leo Enticknap]

Agreed completely. Another rough edge of the DolReMi web UI is that on a DCP2000 or DCP-2K4, there is no way to purge the Enigma logs from it: that button is only on the diagnostics utility of the old VNC UI.

Hopefully in a future software update they will add a certificate expiration nag to the web UI.

[Carsten Kurz]

They wouldn't have to. They would just have to set resonable expiration periods for the stuff they sell. 5-10 Years is not reasonable.

[Marcel Birgelen]

In all fairness, all those ticking time-bombs in the form of expiring and vanishing certificates can legally be seen as planned obsolescence and there will be a time where even Dolby won't supply any new updates to kick the can down the road. While no hardware will last forever, any pre-defined end-date is legally doubtful in my opinion. Dolby or any odd manufacturer may claim that this is how the technology works and there is no way around it, but there is no reason why those certificates need an expiration date to begin with. Yeah, I know that most CA systems don't even support never-expiring certificates and many software is programmed to ignore certificates with expiration dates far in the future, it's not that there is no way around it and it's also not that an infinite certificate would hurt the security of the system. This isn't the on-line transaction portal of some bank, this is only to verify the origin of the machine.

[Carsten Kurz]

Maybe someone once thought, IF there is a security breach in some hardware, then at least that hardware would be rendered useless for encrypted content after the cert expiration.
However, I don't think rights owners would have waited for e.g. 5 years for that problem to come to an end anyway.