It's time to update an expiring SSL certificate, and I'm following instruction here -> http://www-10.lotus.com/ldd/dominowiki.nsf/dx/3rd_Party_SHA-2_with_OpenSSL_and_kyrtool

My first issue was in step 6a - Concatenating the key file and certificates into one file - I received a KYRTOOL error - SECIssUpdateKeyringPrivateKey returned error 0x0720 - Syntax error in OID. Having run into this before, I went on to 6b to import each separately.

Step 7, examine the resulting Keyring file, shows the keys OK, then appears to show the certs OK, but then crashes my notes client!

 

C:\Program Files (x86)\IBM\Notes>kyrtool =notes.ini show certs -k "D:\Users\taylor\Documents\SSL Certificates\xxxxxxxx\xxxxxxxx.kyr"

Using keyring path 'D:\Users\taylor\Documents\SSL Certificates\xxxxxxxx\xxxxxxxx.kyr'

Certificate #0

Subject:        CN=www.xxxxxxxx.com/O=xxxxxxxx Corporation/L=xxxxxxxx/ST=xxxxxxxx/C=US/POST=xxxxxxxx/XX=xxxxxxxx/SerialNumber=xxxxxxxx/XX=xxxxxxxx/XX=US/XX=Private Organization
Issuer:         CN=DigiCert SHA2 Extended Validation Server CA/OU=www.digicert.com/O=DigiCert Inc/C=US
Not Before:     08/11/2015 20:00:00
Not After:      11/09/2017 07:00:00
Key length:     4096 bits

[1A3C:0002-1F7C]  Thread=[1A3C:0002-1F7C]
[1A3C:0002-1F7C] Stack base=0x0042DEC0, Stack size = 9468 bytes
[1A3C:0002-1F7C] PANIC: LookupHandle: handle out of range

C:\Program Files (x86)\IBM\Notes>

I'm using Notes 9.0.1FP3 client with KYRTool 1.01 from April 2015.

Any ideas?