topic AP can't join. DTLS connection closed by controller in Wireless

topic AP can't join. DTLS connection closed by controller in Wireless https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871404#M135636 <HTML><HEAD></HEAD><BODY><P>*Nov  1 12:27:24.999: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY</P><P>*Nov  1 12:27:25.000: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY</P><P>*Nov  1 12:27:35.003: %CAPWAP-3-ERRORLOG: Go join a capwap controller</P><P>*Nov  1 12:27:35.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.2 peer_port: 5246</P><P>*Nov  1 12:27:35.000: %CAPWAP-5-CHANGED: CAPWAP changed state to</P><P>*Nov  1 12:27:35.138: %PKI-3-CERTIFICATE_INVALID_NOT_YET_VALID: Certificate chain validation has failed.  The certificate (SN: 6F5328F20000000F6A57) is not yet valid   Validity period starts on 13:39:13 UTC Nov 17 2011</P><P>*Nov  1 12:27:35.139: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed</P><P>*Nov  1 12:27:35.139: %CAPWAP-3-ERRORLOG: Certificate verification failed!</P><P>*Nov  1 12:27:35.139: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:326 Certificate verified failed!</P><P>*Nov  1 12:27:35.139: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: 192.168.100.2</P><P>*Nov  1 12:27:35.139: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.100.2:5246</P><P>*Nov  1 12:27:35.140: %DTLS-3-BAD_RECORD: Erroneous record received from 192.168.100.2: Malformed Certificate</P><P>*Nov  1 12:27:35.140: %DTLS-5-SEND_ALERT: Send WARNING : Close notify Alert to 192.168.100.2:5246</P><P>*Nov  1 12:27:35.140: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.</P></BODY></HTML> Fri, 02 Dec 2011 20:30:26 GMT Saman Shamim 2011-12-02T20:30:26Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871401#M135633 <P>Hi guys,</P><P></P><P>1140 APs don't register with the 5508 controller. Here are some debug outputs:</P><P></P><P>AP's IP: 100.31</P><P>WLC's IP:100.2</P><P></P><P></P><P><STRONG>debug capwap events enable</STRONG></P><P>*spamApTask1: Nov 01 11:25:04.958: 30:e4:db:d3:a4:ca Discovery Request from 192.168.100.31:47690 </P><P>*spamApTask1: Nov 01 11:25:04.958: 30:e4:db:d3:a4:ca Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 100, joined Aps =0</P><P>*spamApTask1: Nov 01 11:25:04.958: 30:e4:db:d3:a4:ca Discovery Response sent to 192.168.100.31:47690</P><P>*spamApTask1: Nov 01 11:25:04.958: 30:e4:db:d3:a4:ca Discovery Response sent to 192.168.100.31:47690</P><P>*spamApTask1: Nov 01 11:25:14.959: 30:e4:db:d3:a4:ca DTLS connection not found, creating new connection for 192:168:100:31 (47690) 192:168:100:2 (5246)</P><P>*spamApTask1: Nov 01 11:25:15.101: 30:e4:db:d3:a4:ca DTLS connection closed event receivedserver (192:168:100:2/5246) client (192:168:100:31/47690)</P><P>*spamApTask1: Nov 01 11:25:15.101: 30:e4:db:d3:a4:ca No entry exists for AP (192:168:100:31/47690)</P><P>*spamApTask1: Nov 01 11:25:15.101: 30:e4:db:d3:a4:ca No AP entry exist in temporary database for 192.168.100.31:47690</P><P></P><P>**************************************************************</P><P></P><P><STRONG>debug capwap packet enable</STRONG></P><P></P><P>>*spamApTask1: Nov 01 11:36:20.039: <<<<  Start of CAPWAP Packet  >>>></P><P>*spamApTask1: Nov 01 11:36:20.039: CAPWAP Control mesg Recd from 192.168.100.31, Port 47690</P><P>*spamApTask1: Nov 01 11:36:20.039:              HLEN 4,   Radio ID 0,    WBID 1</P><P>*spamApTask1: Nov 01 11:36:20.039:              Msg Type   :   CAPWAP_DISCOVERY_REQUEST</P><P>*spamApTask1: Nov 01 11:36:20.039:              Msg Length : 73</P><P>*spamApTask1: Nov 01 11:36:20.039:              Msg SeqNum : 0</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>*spamApTask1: Nov 01 11:36:20.039:       Type : CAPWAP_MSGELE_DISCOVERY_TYPE, Length 1</P><P>*spamApTask1: Nov 01 11:36:20.039:              Discovery Type : CAPWAP_DISCOVERY_TYPE_UNKNOWN</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>*spamApTask1: Nov 01 11:36:20.039:       Type : CAPWAP_MSGELE_WTP_DESCRIPTOR, Length 40</P><P>*spamApTask1: Nov 01 11:36:20.039:              Maximum Radios Supported  : 0</P><P>*spamApTask1: Nov 01 11:36:20.039:              Radios in Use             : 0</P><P>*spamApTask1: Nov 01 11:36:20.039:              Encryption Capabilities   : 0x00 0x01</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>*spamApTask1: Nov 01 11:36:20.039:       Type : CAPWAP_MSGELE_WTP_FRAME_TUNNEL, Length 1</P><P>*spamApTask1: Nov 01 11:36:20.039:              WTP Frame Tunnel Mode : NATIVE_FRAME_TUNNEL_MODE</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>*spamApTask1: Nov 01 11:36:20.039:       Type : CAPWAP_MSGELE_WTP_MAC_TYPE, Length 1</P><P>*spamApTask1: Nov 01 11:36:20.039:              WTP Mac Type  : SPLIT_MAC</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>*spamApTask1: Nov 01 11:36:20.039:       Type : CAPWAP_MSGELE_VENDOR_SPECIFIC_PAYLOAD, Length 10</P><P>*spamApTask1: Nov 01 11:36:20.039:              Vendor Identifier  : 0x00409600</P><P>*spamApTask1: Nov 01 11:36:20.039:</P><P>        IE            :   UNKNOWN IE 207</P><P></P><P>*spamApTask1: Nov 01 11:36:20.039:      IE Length     :   4</P><P></P><P>*spamApTask1: Nov 01 11:36:20.039:      Decode routine not available, Printing Hex Dump</P><P></P><P>*spamApTask1: Nov 01 11:36:20.039: 00000000: 01 00 00 01                                       ....</P><P></P><P></P><P>*spamApTask1: Nov 01 11:36:20.039: <<<<  End of CAPWAP Packet  >>>></P><P></P><P></P><P>**************************************************************</P><P></P><P><STRONG>debug capwap errors enable</STRONG></P><P>*spamApTask1: Nov 01 11:45:15.244: 30:e4:db:d3:a4:ca Deleting AP 192.168.100.31 which has not been plumbed</P><P>*spamApTask1: Nov 01 11:45:15.245: 30:e4:db:d3:a4:ca DTLS connection was closed</P><P></P><P></P><P>**************************************************************<BR /> <BR /></P><P><STRONG>debug capwap detail enable</STRONG></P><P></P><P>*spamApTask1: Nov 01 11:52:45.298: 30:e4:db:d3:a4:ca CAPWAP Control Msg Received from 192.168.100.31:47690</P><P></P><P>*spamApTask1: Nov 01 11:52:45.298: 30:e4:db:d3:a4:ca DTLS connection 0x1454bc38 closed by controller</P><P>*spamApTask1: Nov 01 11:52:45.299: CAPWAP DTLS connection closed msg</P> Sun, 04 Jul 2021 04:10:04 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871401#M135633 Saman Shamim 2021-07-04T04:10:04Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871402#M135634 <HTML><HEAD></HEAD><BODY><P>What does the log show when you are consoled into the AP? Is it just one AP or a bunch?</P><P></P><P>Sent from my iPhone</P></BODY></HTML> Fri, 02 Dec 2011 20:22:14 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871402#M135634 Scott Fella 2011-12-02T20:22:14Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871403#M135635 <HTML><HEAD></HEAD><BODY><P>I haven't consoled into AP yet. I'll do it now and post the outputs.</P><P></P><P>First I connected 3 APs and then disconnected 2 of them to make debug outputs more readable. So currently just one AP is connected to the network</P></BODY></HTML> Fri, 02 Dec 2011 20:24:36 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871403#M135635 Saman Shamim 2011-12-02T20:24:36Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871404#M135636 <HTML><HEAD></HEAD><BODY><P>*Nov  1 12:27:24.999: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY</P><P>*Nov  1 12:27:25.000: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY</P><P>*Nov  1 12:27:35.003: %CAPWAP-3-ERRORLOG: Go join a capwap controller</P><P>*Nov  1 12:27:35.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.2 peer_port: 5246</P><P>*Nov  1 12:27:35.000: %CAPWAP-5-CHANGED: CAPWAP changed state to</P><P>*Nov  1 12:27:35.138: %PKI-3-CERTIFICATE_INVALID_NOT_YET_VALID: Certificate chain validation has failed.  The certificate (SN: 6F5328F20000000F6A57) is not yet valid   Validity period starts on 13:39:13 UTC Nov 17 2011</P><P>*Nov  1 12:27:35.139: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed</P><P>*Nov  1 12:27:35.139: %CAPWAP-3-ERRORLOG: Certificate verification failed!</P><P>*Nov  1 12:27:35.139: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:326 Certificate verified failed!</P><P>*Nov  1 12:27:35.139: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: 192.168.100.2</P><P>*Nov  1 12:27:35.139: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.100.2:5246</P><P>*Nov  1 12:27:35.140: %DTLS-3-BAD_RECORD: Erroneous record received from 192.168.100.2: Malformed Certificate</P><P>*Nov  1 12:27:35.140: %DTLS-5-SEND_ALERT: Send WARNING : Close notify Alert to 192.168.100.2:5246</P><P>*Nov  1 12:27:35.140: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.</P></BODY></HTML> Fri, 02 Dec 2011 20:30:26 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871404#M135636 Saman Shamim 2011-12-02T20:30:26Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871405#M135637 <HTML><HEAD></HEAD><BODY><P>Check your time on the wlc. It's off so that is why the AP's ate not joining.</P><P></P><P>Sent from my iPhone</P></BODY></HTML> Fri, 02 Dec 2011 20:32:11 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871405#M135637 Scott Fella 2011-12-02T20:32:11Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871406#M135638 <HTML><HEAD></HEAD><BODY><P>*Nov  1 12:27:35.138: %PKI-3-CERTIFICATE_INVALID_NOT_YET_VALID:  Certificate chain validation has failed.  <STRONG>The certificate (SN:  6F5328F20000000F6A57) is not yet valid   Validity period starts on  13:39:13 UTC Nov 17 2011</STRONG></P><P></P><P>This is why.. the certificate exchange is failing.</P></BODY></HTML> Fri, 02 Dec 2011 20:35:45 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871406#M135638 Scott Fella 2011-12-02T20:35:45Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871407#M135639 <HTML><HEAD></HEAD><BODY><P>Well, the WLC was a month late (November 1st) !!! </P><P></P><P>Fixed it and now everything is good.</P><P></P><P>Thanks a lot Scott</P></BODY></HTML> Fri, 02 Dec 2011 20:44:41 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871407#M135639 Saman Shamim 2011-12-02T20:44:41Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871408#M135640 <HTML><HEAD></HEAD><BODY><P>No problem:)</P><P></P><P>Sent from my iPhone</P></BODY></HTML> Fri, 02 Dec 2011 20:52:41 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871408#M135640 Scott Fella 2011-12-02T20:52:41Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871409#M135641 <HTML><HEAD></HEAD><BODY><P>Good catch Scott. Thanks for helping Cisco Partners.  <SPAN __jive_emoticon_name="happy" __jive_macro_name="emoticon" class="jive_macro jive_emote" src="https://community.cisco.com/4.5.4/images/tiny_mce3/plugins/jiveemoticons/images/spacer.gif"></SPAN></P><P></P><P>Vinay Sharma</P><P>Community Manager - Wireless</P></BODY></HTML> Sat, 03 Dec 2011 05:51:12 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871409#M135641 Vinay Sharma 2011-12-03T05:51:12Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871410#M135642 <HTML><HEAD></HEAD><BODY><P>Im moving from controller A to Controller B with the same version of software and any of the APs join to my new controller. Im getting the same debug outputs than this original POST. <BR />I have to clear the prive config too?</P></BODY></HTML> Fri, 20 Dec 2013 22:59:19 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871410#M135642 Gustavo Adolfo Villanueva Ramirez 2013-12-20T22:59:19Z AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871411#M135643 <HTML><HEAD></HEAD><BODY><P> El problema del post Original es que tiene incorrecta la fecha del WLC. En tu caso la fecha es correcta? tu nuevo WLC esta en el mismo segmento de red que el original?</P></BODY></HTML> Fri, 20 Dec 2013 23:02:51 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871411#M135643 Daniel Ordóñez Flores 2013-12-20T23:02:51Z Came across this 4 years https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871412#M135644 <P>Came across this 4 years later but THANKS!  I was scratching my head for an hour and couldn't figure out just why my AP wasn't joining.  Fixed the time on WLC and AP and got DTLS up instantly.</P> <P>-Ricky</P> Wed, 10 Feb 2016 02:10:32 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871412#M135644 Ricky Sandhu 2016-02-10T02:10:32Z Hello all , https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871413#M135645 <P>Hello all ,</P> <P>    my lightweight AP(3502i) is not joining with virtual Wireless Lan Controller </P> <P>my Ap is getting IP from DHCP , but it shows not joined  in wlc, can you please tell me what was the problem,</P> <P></P> <P></P> <P>APa44c.11d3.3ae9#sh version<BR />Cisco IOS Software, C3500 Software (AP3G1-RCVK9W8-M), Version 12.4(23c)JA3, RELEASE SOFTWARE (fc1)<BR />Technical Support: <A href="http://www.cisco.com/techsupport" target="_blank">http://www.cisco.com/techsupport</A><BR />Copyright (c) 1986-2011 by Cisco Systems, Inc.<BR />Compiled Tue 18-Oct-11 15:02 by prod_rel_team</P> <P>ROM: Bootstrap program is C3500 boot loader<BR />BOOTLDR: C3500 Boot Loader (AP3G1-BOOT-M) Version 12.4(23c)JA5, RELEASE SOFTWARE (fc1)</P> <P>APa44c.11d3.3ae9 uptime is 24 minutes<BR />System returned to ROM by power-on<BR />System image file is "flash:/ap3g1-rcvk9w8-mx/ap3g1-rcvk9w8-mx"</P> <P><BR />This product contains cryptographic features and is subject to United<BR />States and local country laws governing import, export, transfer and<BR />use. Delivery of Cisco cryptographic products does not imply<BR />third-party authority to import, export, distribute or use encryption.<BR />Importers, exporters, distributors and users are responsible for<BR />compliance with U.S. and local country laws. By using this product you<BR />agree to comply with applicable laws and regulations. If you are unable<BR />to comply with U.S. and local laws, return this product immediately.</P> <P>A summary of U.S. laws governing Cisco cryptographic products may be found at:<BR />http://www.cisco.com/wwl/export/crypto/tool/stqrg.html</P> <P>If you require further assistance please contact us by sending email to<BR />export@cisco.com.</P> <P>cisco AIR-CAP3502I-E-K9 (PowerPC460exr) processor (revision A0) with 81910K/49152K bytes of memory.<BR />Processor board ID FCZ1623W0UL<BR />PowerPC460exr CPU at 666Mhz, revision number 0x18A8<BR />Last reset from power-on<BR />LWAPP image version 7.0.112.74<BR />1 Gigabit Ethernet interface</P> <P>32K bytes of flash-simulated non-volatile configuration memory.<BR />Base ethernet MAC Address: A4:4C:11:D3:3A:E9<BR />Part Number : 73-12175-05<BR />PCA Assembly Number : 800-32268-05<BR />PCA Revision Number : A0<BR />PCB Serial Number : FOC16175AYN<BR />Top Assembly Part Number : 800-32891-01<BR />Top Assembly Serial Number : FCZ1623W0UL<BR />Top Revision Number : A0<BR />Product/Model Number : AIR-CAP3502I-E-K9</P> <P>Configuration register is 0xF</P> <P>APa44c.11d3.3ae9#<BR />*Apr 16 07:12:23.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.100.3.72 peer_port: 5246<BR />*Apr 16 07:12:23.003: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed<BR />*Apr 16 07:12:23.003: %CAPWAP-3-ERRORLOG: Certificate verification failed!<BR />*Apr 16 07:12:23.003: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:348 Certificate verified failed!<BR />*Apr 16 07:12:23.003: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: 10.100.3.72<BR />*Apr 16 07:12:23.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.100.3.72:5246<BR />*Apr 16 07:12:23.003: %DTLS-3-BAD_RECORD: Erroneous record received from 10.100.3.72: Malformed Certificate<BR />*Apr 16 07:12:23.003: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.100.3.72:5246<BR />*Apr 16 07:12:23.003: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.</P> <P>-----------------------------</P> <P>from wlc</P> <P>(Cisco Controller) >show ap join stats summary all</P> <P>Number of APs.............................................. 2</P> <P>Base Mac AP EthernetMac AP Name IP Address Status<BR />67:58:34:01:00:00 N A N A 10.100.3.7 Not Joined<BR />a4:4c:11:d3:3a:e9 N A APa44c.11d3.3ae9 10.100.3.7 Not Joined</P> <P><BR />(Cisco Controller) >show sysinfo</P> <P>Manufacturer's Name.............................. Cisco Systems Inc.<BR />Product Name..................................... Cisco Controller<BR />Build Name....................................... Engg Special Image</P> <P>Product Version.................................. 8.2.100.0<BR />RTOS Version..................................... 8.2.100.0<BR />Bootloader Version............................... 8.2.100.0<BR />Emergency Image Version.......................... 8.2.100.0</P> <P>Build Type....................................... DATA + WPS</P> <P>System Name...................................... Cisco_66:e5:93<BR />System Location..................................<BR />System Contact...................................<BR />System ObjectID.................................. 1.3.6.1.4.1.9.1.1631<BR />IP Address....................................... 10.100.3.72<BR />IPv6 Address..................................... ::<BR />System Up Time................................... 0 days 0 hrs 30 mins 58 secs<BR />System Timezone Location.........................<BR />System Stats Realtime Interval................... 5<BR />System Stats Normal Interval..................... 180</P> <P>--More-- or (q)uit</P> <P>Configured Country............................... US - United States</P> <P>State of 802.11b Network......................... Enabled<BR />State of 802.11a Network......................... Enabled<BR />Number of WLANs.................................. 2<BR />Number of Active Clients......................... 0</P> <P>Burned-in MAC Address............................ 00:0C:29:66:E5:93<BR />Maximum number of APs supported.................. 200<BR />System Nas-Id....................................<BR />WLC MIC Certificate Types........................ SHA1<BR />Licensing Type................................... RTU<BR />vWLC config...................................... Small</P> Tue, 17 May 2016 07:23:34 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871413#M135645 sifathmirza 2016-05-17T07:23:34Z Thanks it work https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871414#M135646 <P>I change the time on WLC.Then It's working.Thanks.!!!!</P> Wed, 18 May 2016 03:11:29 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/1871414#M135646 supun1989 2016-05-18T03:11:29Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3189493#M135647 Hi Scott, thanks for your help i had the same problem it fixed. Tue, 26 Sep 2017 09:52:18 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3189493#M135647 kayoka phiri 2017-09-26T09:52:18Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3397099#M135648 <P>Hello,</P> <P> </P> <P>i am having the same issue as you, and i appreciate if you can help me to fix the issue i am having the below error message on the AP.</P> <P> </P> <P><STRONG>The certificate (SN:  6F5328F20000000F6A57) is not yet valid   Validity period starts on  13:39:13 UTC Nov 17 2011</STRONG></P> <P> </P> <P><STRONG>could you please help me.</STRONG></P> Sun, 10 Jun 2018 23:16:27 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3397099#M135648 Ahmed.Amri 2018-06-10T23:16:27Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3756909#M135649 <P>DTLS connection may fail due to expired license, check "show license all" and if you find license expired, go to Management-- software activation-- License and add new license.</P> <P> </P> Mon, 03 Dec 2018 15:22:46 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3756909#M135649 Amit Singh 2018-12-03T15:22:46Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3888740#M135650 <P>The date had to do with the cert failing?</P> Thu, 11 Jul 2019 20:00:08 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3888740#M135650 pabene 2019-07-11T20:00:08Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3905782#M135651 <P>Hi Cisco Team,</P><P> </P><P>We have almost the same issue but it happens when we fail over the link from ISP 1 to ISP 2. The AP cannot join to WLC but from WLC side I can ping the access point. Please help us guys. Thanks</P> Fri, 09 Aug 2019 05:55:11 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3905782#M135651 r.cruzate 2019-08-09T05:55:11Z Re: AP can't join. DTLS connection closed by controller https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3989745#M135652 <P>Like most have said the issue was with the time, the ap can only sync with the controller if the date,time and country configured is the same on both ends.</P> Tue, 26 Nov 2019 19:23:23 GMT https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/m-p/3989745#M135652 kayoka phiri 2019-11-26T19:23:23Z