vania-janet/multiturn-rag-retrieval-data huggingface dataset:
(https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-master-key-rotation-key-smart-cardstroubleshoot-master-key-rotation-key-smart-cards)

[Why do I fail to load the new master key during the master key rotation process?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-master-key-rotationtroubleshoot-master-key-rotation)





 Troubleshooting smart cards and the Management Utilities 

[Why am I not authorized when I start the Trusted Key Entry application?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unauthorized-token-tke-applicationtroubleshoot-unauthorized-token-tke-application)

[Why am I receiving a blocked PIN on EP11 smart card error?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-block-smart-cardtroubleshoot-block-smart-card)

[Why am I receiving a no smart card readers found error when I use the Management Utilities?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-no-smart-cardtroubleshoot-no-smart-card)





 Troubleshooting Trusted Key Entry 

[Why am I not authorized when running TKE CLI plug-in commands?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unauthorized-tokentroubleshoot-unauthorized-token)

[Why can't I change signature thresholds?](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-troubleshoot-unable-to-change-signature-thresholdstroubleshoot-unable-to-change-signature-thresholds)

[Why can't I list crypto units?]
"collectionTotal": 1,
"collectionType": "application/vnd.ibm.kms.policy+json"
},
"resources": [
{
"id": "a1769941-9805-4593-b6e6-290e42dd1cb5",
"rotation": {
"interval_month": 1
},
"createdby": "IBMid-503CKNRHR7",
"createdat": "2019-03-06T16:31:05Z",
"updatedby": "IBMid-503CKNRHR7",
"updatedat": "2019-03-06T16:31:05Z"
}
]
}







 Updating a rotation policy 

Update an existing policy for a root key by making a PUT call to the following endpoint.

https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/policies



1. [Retrieve your service and authentication credentials](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api).
2. Replace the rotation policy for a specified key by running the following cURL command.

curl -X PUT 
https://api.<region>.hs-crypto.cloud.ibm.com:<port>/api/v2/keys/<key_ID>/policies 
-H 'authorization: Bearer <IAM_token>' 
-H 'bluemix-instance: <instance_ID>' 
-H 'correlation-id: <correlation_ID>' 
-H 'content-type: application/vnd.ibm.kms.policy+json' 
-d '{
"metadata": {
"collectionType": "application/vnd.ibm.kms.policy+json",
"collectionTotal": 1
},
"resources": [
{
For more information, see [Bulk document validation and conflict errors](https://cloud.ibm.com/docs/Cloudant?topic=Cloudant-bulk-operationsbulk-document-validation-and-conflict-errors).

See an example response content after successful bulk insert of two documents:

[
{
"ok": true,
"id": "id1",
"rev": "2-402c81fee7ae6e723ff08bb166703a50"
},
{
"id": "id2",
"error": "conflict",
"reason": "Document update conflict."
}
]





 Updating documents in bulk 

The bulk document update procedure is similar to the insertion procedure, except that you must specify the document ID and current revision for every document in the bulk update JSON string.

See an example of using HTTP to do a bulk update:

POST /$DATABASE/_bulk_docs HTTP/1.1
Accept: application/json

See an example of using the command line to do a bulk update:



* Curl
* Java
* Python
* Go
* Node
It is possible that you will need to update an organization MSP definition, such as the display name, or certificates that are included inside the MSP. You can also enable Node OU support on the MSP. Enabling Node OU support is recommended because it greatly simplifies the steps required after certificates are renewed.

It is recommended that you do not change the msp_id field as this might cause breaking changes to your network.

To update your MSP:



* Export the existing MSP definition from the Organizations tab and edit the generated JSON file to modify the display name, the existing certificates, or add new certificates.
* Click your MSP definition in the Organizations tab to open it and then click the Settings icon.
* If the MSP was created in this console and Node OU support is not enabled, the Node OU checkbox is selected because you have the opportunity to enable the support now. If you only want to enable Node OU support on the MSP, you do not need to add a new JSON file, you can go ahead and click Update MSP definition now. This action inserts the "fabric_node_ous": section into the JSON along with the appropriate certificates for the organization. Be aware that this action also updates the organization admin certificates on the nodes configured with this MSP definition and each node is restarted to reflect the update.
* (Optional) If you made updates to the MSP JSON definition, click Add file to upload the new JSON file.
* Click Update MSP definition.
* It is very important to re-export this MSP now and share it with all of the members of the consortium so they can import it into their console and ensure they are using the latest copy of the MSP definition and certificates.



If you need to add a new admin certificate to an existing organization MSP definition, refer to the topic on [managing certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmt).





 Manually building an MSP JSON file 

This option is for advanced users only who are familiar with how certificates are used in blockchain identity management.
If Node OU support was not enabled when the identity was originally enrolled, then you should use the new exported certificate and follow the manual update steps [2](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-msp) - [7](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel) to update the admin certificate in the MSP, peer, orderer, and channel. Before attempting these steps, review the next section that describes the ordering node override that needs to be configured if any of the channel member or channel orderer organization admin certs have expired.





 Override orderer configuration to allow expired certs for channel updates 

After the admin certificate is updated in the MSP, any channels that the MSP belongs to also have to be updated manually. But, if any of the channel member certificates or channel orderer organization admin certificates have expired, you need to override the ordering service configuration to temporarily allow expired certificates.

Fabric includes a [setting](https://hyperledger-fabric.readthedocs.io/en/release-2.1/raft_configuration.htmlcertificate-expiration-related-authentication) that allows the channel to ignore expiration checks in order for channel updates to be applied to fix expired certificates. You need to override the NoExpirationChecks setting on each ordering node in the ordering service.



1. Open the ordering service and click the Ordering nodes tab.
2. Open the first ordering node and click the Settings icon.
3. In the side panel, click Edit configuration JSON (Advanced)
4. Under Configuration updates paste in the following snippet:

{
"General": {
"Authentication": {
"NoExpirationChecks": true
}
}
}
5. Click Update ordering node.
6. Repeat these steps for each ordering node in the ordering service.
apiconnect.consumer_org_update.update Update the Consumer Organization object by name or ID 
 apiconnect.consumer_org_del.delete Delete the Consumer Organization object by name or ID 
 apiconnect.consumer_org_transferOwner.create Transfer owner to an associate 
 apiconnect.consumer_org_createSpaceInitiated.create Create a Consumer Organization object 
 apiconnect.consumer_org_clearSpaceInitiated.delete Clear the Consumer Organization objects 
 apiconnect.consumer_org_updateSpaceInitiated.update Update the Consumer Organization object by name or ID 
 apiconnect.consumer_org_delSpaceInitiated.delete Delete the Consumer Organization object by name or ID 
 apiconnect.consumer_org_transferOwnerSpaceInitiated.create Transfer owner to an associate 
 apiconnect.group_createCatalogScope.create Create a Group object 
 apiconnect.group_clearCatalogScope.delete Clear the Group objects 
 apiconnect.group_updateCatalogScope.update Update the Group object by name or ID 
 apiconnect.group_delCatalogScope.delete Delete the Group object by name or ID 
 apiconnect.group_createSpaceInitiated.create Create a Group object 
 apiconnect.group_clearSpaceInitiated.delete Clear the Group objects 
 apiconnect.group_updateSpaceInitiated.update Update the Group object by name or ID 
 apiconnect.group_delSpaceInitiated.delete Delete the Group object by name or ID 
 apiconnect.payment_method_create.create Create a Payment Method object 
 apiconnect.payment_method_update.update Update the Payment Method object by name or ID 
 apiconnect.payment_method_del.delete Delete the Payment Method object by name or ID 
 apiconnect.payment_method_createSpaceInitiated.create Create a Payment Method object 
 apiconnect.payment_method_updateSpaceInitiated.update Update the Payment Method object by name or ID
<br> <br>Otherwise, [Update channel](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel-peer) <br> <br>or <br> <br>[Bulk admin certificate update with Ansible playbooks](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-bulk-ansible) All consortium members and ordering service admin need to import the updated MSP into their Organizations tab. <br> <br>Ordering service admin needs to [Update ordering service channel member](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-os-channel-member). Transactions can continue to work successfully. <br> <br>But you are unable to install new smart contracts from a client application or manage the peer from the console. See [Expired certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs). 







 Ordering service MSP admin certificate 

The following diagram summarizes the process for updating orderer organization admin certificates on your network. Click a circle to view the instructions.

![Orderer organization admin certificate renewal process.](https://cloud.ibm.com/docs-content/v1/content/c5288bed34c3820e3a5251d820ee91adcd2591a3/blockchain/images/orderer-admin-nodesv2.png)


[View certificate expiration date](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-renewal)

[Enroll a new identity](/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-enroll)
Any changes that you make to an existing service ID, such as changing the assigned policies or deleting an API key that is used, might cause service interruptions to applications that use that service ID.





 Updating a service ID by using the API 

To update a service ID, call the [IAM Identity Services API](https://cloud.ibm.com/apidocs/iam-identity-token-apiupdate-service-id) as shown in the following example:



* Curl
* Java
* Python
* Go
* Node



curl -X PUT 'https://iam.cloud.ibm.com/v1/serviceids/SERVICE_ID_UNIQUE_ID' -H 'Authorization: Bearer TOKEN' -H 'If-Match: <value of etag header from GET request>' -H 'Content-Type: application/json' -d '{
"name": "My-super-secret-serviceid",
"description": "super secret service ID"
}'

UpdateServiceIdOptions updateServiceIdOptions = new UpdateServiceIdOptions.Builder()
.id(svcId)
.ifMatch(svcIdEtag)
.description("This is an updated description")
.build();

Response<ServiceId> response = service.updateServiceId(updateServiceIdOptions).execute();
ServiceId serviceId = response.getResult();
System.out.println(serviceId.toString());

service_id = iam_identity_service.update_service_id(
id=svc_id,
if_match=svc_id_etag,
description='This is an updated description'
).get_result()

print(json.dumps(service_id, indent=2))

updateServiceIDOptions := iamIdentityService.NewUpdateServiceIDOptions(svcID, svcIDEtag)
updateServiceIDOptions.SetDescription("This is an updated description")
Why am I receiving a 409 conflict error code when I update or delete a load balancer? 

Use the information in this topic to resolve 409 conflict error codes when updating or deleting a load balancer.

  What’s happening 

You receive a 409 error code when updating or deleting a load balancer.

  Why it’s happening 

The HTTP 409 status code indicates that the request could not be processed because of conflict in the request. If you are receiving this status code, it might be for one of the following reasons:



*  You cannot update the load balancer configuration if the load balancer status is not ACTIVE.
*  You cannot delete a load balancer if the load balancer status is not ACTIVE or ERROR.
*  You cannot delete a load balancer that is already in DELETE_PENDING state.
*  You cannot delete a load balancer if it has one or more pools that are attached to instance groups.
*  You cannot delete a load balancer pool if it is attached to an instance group.
*  You cannot add/delete/update members to a pool that is managed by an instance group.



  How to fix it 

Check and resolve any of the possible existing causes listed previously.
2. Scroll down to the Ordering service consenters table and click the action menu ![action menu](https://cloud.ibm.com/docs-content/v1/content/icons/overflow-menu.svg), next to the URL and click Update orderer certificates.
3. Copy and paste the name of the consenter set, displayed at the top of the side panel.
4. To submit this update request to the channel members, you need to select the ordering service MSP from the drop-down list and then the associated orderer organization admin identity from your wallet. When you click Update consenter a channel update notification is sent to the consortium members for approval.
5. After enough channel members approve this update according to the channel update policy, the ordering node can resume participation in the consenter set.
6. Repeat these steps for every channel that includes this ordering node as a consenter.







 Peer and ordering node organization admin certificates 

When organization admin certificates are generated by an external CA, these certificates are [manually added](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-organizationsconsole-organizations-build-msp) to the organization MSP JSON file. And when they are updated, the certificate inside the JSON file also needs to be updated. Certificate expiration dates depend on the certificate provider but are also visible from the MSP tile in the Organizations tab. Follow the same processes that are described in steps [2](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-msp) - [7](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel) to update the admin certificate in the MSP, peer, orderer, and channel.
For information about the update command, see [hpvs-update-instance](https://cloud.ibm.com/docs/hpvs-cli-pluginhpvsinstanceupdate).



 Updating the authorized_keys file 

Before you update your IBM-provided image, make sure that the root users' authorized_keys file is located within /data/.ssh and the correct file permissions are in place.

If you update your virtual server and the file is not in the correct directory, you lose access to your virtual server forever as recovery is not possible. Instances newer than 10 September 2020 are preconfigured correctly.

To place the authorized_keys file images in the data/.ssh directory, complete the following steps:



1. Create the directory .ssh within /data:

mkdir /data/.ssh
2. Copy the authorized_keys file:

cp /home/root/.ssh/authorized_keys /data/.ssh/authorized_keys
3. Make sure the owner of /data/.ssh and /data/.ssh is root:root.
4. Make sure the file permissions for /data.ssh are drwxr-xr-x.
5. Make sure the file permissions for /data/.ssh/authorized_keys are -rw-r--r--.
6. Rename the original file:

mv /home/root/.ssh/authorized_keys /home/root/.ssh/authorized_keys.backup
7. Create a symlink as the one within the current image:

ln -s /data/.ssh/authorized_keys /home/root/.ssh/authorized_keys
8. Important: Do not disconnect unless you verified that you can connect with the new setup.
9. Open a new terminal and verify that you can connect with your private key (close the new terminal afterward and continue in the old one).
10. Optionally delete /home/root/.ssh/authorized_keys.backup.









 Updating your own server
<br> <br>Otherwise, [Update ordering service admin](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-os-admin) <br> <br>or <br> <br>[Bulk admin certificate update with Ansible playbooks](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-bulk-ansible). All consortium members need to import the updated MSP into their Organizations tab. <br> <br>One consortium member needs to submit the request to [update the orderer member MSP on the application channel](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtcert-mgmt-manual-update-channel). Transactions can continue to work successfully. <br> <br>But you are unable to modify channels from a client application or manage the orderer from the console. See [Expired certificates](https://cloud.ibm.com/docs/blockchain?topic=blockchain-cert-mgmtibp-console-identities-expired-certs). 











 Manual certificate renewal 

While the platform automatically renews the certificates for peer and ordering nodes if the associated CA is available, customers are responsible for managing certificate expiration and renewal of the following certificates:



* CA TLS certificate
* Peer and ordering node enrollment and TLS certificates, only when automatic renewal is not successful
* MSP admin certificates
* Certificates from an external CA.



If the admin certificates have been stored or imported into the console wallet, you can monitor the exact date of expiration for each identity. Click an admin identity tile to view the expiration date of the certificate and private key.

Zoom

!
"_rev": "3-8a245604ee5e829d7fbd1b456aed01ac"
}
]
}

See an example JSON structure that is returned after bulk delete:

[
{
"ok": true,
"id": "person34567",
"rev": "3-674ccbb6ec6fe6d7ba0fb30a5eecf664"
},
{
"ok": true,
"id": "person568",
"rev": "4-c6067e21e97557f54d29282461843037"
}
]





 Bulk documents transaction semantics 

If your request receives a [202 response](https://cloud.ibm.com/apidocs/cloudantlist-of-http-codes), the only certainty is that some of the document tasks were processed completely. The response body contains the list of documents that were successfully inserted or updated during the process.

A successful document update is indicated by the presence of a new _rev parameter for the document, indicating that a new document revision was successfully created.

If a document update failed, then you get an error of type conflict for that document. In this case, no new revision was created. You must submit the document update again, with the same revision tag, to retry the document update.

See an example bulk update response with errors:

[
{
"id" : "FishStew",
"error" : "conflict",
"reason" : "Document update conflict."
},
{
"id" : "LambStew",
"error" : "conflict",
"reason" : "Document update conflict."
},
{
"id" : "7f7638c86173eb440b8890839ff35433",
"error" : "conflict",
"reason" : "Document update conflict."
}
]
Show more
Update the consenter set on the ordering service system channel (TLS certificate renewal only)

When you update the TLS certificate, you also need to update the consenter set on the ordering service system channel. This action ensures that any new application channels which include this ordering node as a consenter will use the updated TLS certificate.

In order to update the ordering service, you must have the ordering service organization admin identity in your wallet.



1. Go back to the Ordering service page and scroll down to the Ordering service consenters table.
2. Click the action menu ![action menu](https://cloud.ibm.com/docs-content/v1/content/icons/overflow-menu.svg) next to the URL, and click Update orderer certificates.
3. After you copy and paste the name of the ordering service consenter set, displayed at the top of the side panel, and click Update consenter, the base-64 encoded TLS certificate is added to the consenter set of the ordering service system channel.



Update the consenter set on the application channel (TLS certificate renewal only)

Next we have to update the TLS certificate for this ordering node on all application channels that include this ordering node as a consenter. Until you complete these steps and enough channels members approve the generated channel update request, the ordering node is not able to act as a consenter on the channel. Therefore, ensure there are enough other ordering nodes available in the consenter set to maintain quorum while this node is unavailable.

In order to update the application channel, you need to have the channel member admin identity in your wallet.



1. From the Channels tab, open the application channel that you need to update and click the Channel details tab.
2. Scroll down to the Ordering service consenters table and click the action menu ![action menu](https://cloud.ibm.com/docs-content/v1/content/icons/overflow-menu.svg), next to the URL and click Update orderer certificates.
3. Copy and paste the name of the consenter set, displayed at the top of the side panel.
4.
After you copy and paste the name of the ordering service consenter set, displayed at the top of the side panel, and click Update consenter, the base-64 encoded TLS certificate is added to the consenter set of the ordering service system channel.



Update the consenter set on the application channel (TLS certificate renewal only)

Next we have to update the TLS certificate for this ordering node on all application channels that include this ordering node as a consenter. Until you complete these steps and enough channels members approve the generated channel update request, the ordering node is not able to act as a consenter on the channel. Therefore, ensure there are enough other ordering nodes available in the consenter set to maintain quorum while this node is unavailable.

In order to update the application channel, you need to have the channel member admin identity in your wallet.



1. From the Channels tab, open the application channel that you need to update and click the Channel details tab.
2. Scroll down to the Ordering service consenters table and click the action menu ![action menu](https://cloud.ibm.com/docs-content/v1/content/icons/overflow-menu.svg), next to the URL and click Update orderer certificates.
3. Copy and paste the name of the consenter set, displayed at the top of the side panel.
4. To submit this update request to the channel members, you need to select the ordering service MSP from the drop-down list and then the associated orderer organization admin identity from your wallet. When you click Update consenter a channel update notification is sent to the consortium members for approval.
5. After enough channel members approve this update according to the channel update policy, the ordering node can resume participation in the consenter set.
6. Repeat these steps for every channel that includes this ordering node as a consenter.







 Considerations for a single node ordering service 

If you are using a single-node ordering service and need to renew the ordering node TLS certificate, additional steps are required.