捆绑在 AP IOS 映像中的映像签名证书于 2012 年 12 月 4 日颁发，并于 2022 年 12 月 4 日到期。IOS AP 使用此证书来验证从 WLC 下载的映像，然后再在 AP 上安装软件。因此，在 2022 年 12 月 4 日之后，当 AP 由于软件升级/降级或由于在运行不同版本的 WLC 之间移动而下载代码时，AP 将无法验证映像并将无限期地保持在下载映像循环中。所有 AireOS 和 IOS-XE 版本都会出现此问题。
症状
要验证您是否遇到此问题，请首先检查 WLC 是否存在卡在下载状态的 AP。然后，为了确定问题，ssh、telnet 或console进入受影响的 AP 并查看它们的日志（或在您的系统日志服务器上查找 AP 日志。）
在 AireOS WLC 上
在 WLC 上，show ap image status (AireOS 8.10) 将显示受影响的 AP 处于“Downloading”状态。
在 8.5 中，使用show ap image all将在“Downloading”中显示非零数量的 AP。
(AireOS WLC-8.5) >show ap image all
Total number of APs.............................. 1
Number of APs
Initiated....................................... 0
Downloading..................................... 1
Predownloading.................................. 0
Completed predownloading........................ 0
Not Supported................................... 0
Failed to Predownload........................... 0
Predownload Predownload Flexconnect
AP Name Primary Image Backup Image Status Version Next Retry Time Retry Count Predownload
------------------ -------------- -------------- --------------- -------------- ---------------- ------------ --------------
AP1700 8.5.182.0 0.0.0.0 None None NA NA
(AireOS WLC-8.10) >show ap image status
Total number of APs.............................. X
Total AP's Downloading........................... 1
AP Name Primary Image Download Status
------------------ -------------- ----------------
CAP3702E.4CD4 17.3.6.76 Downloading
在 IOS-XE C9800 WLC 上
C9800#show ap summar
9800-L#show ap summary
AP Name Slots AP Model Ethernet MAC Radio MAC Location Country IP Address State
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
AP2702E 2 2702E 0081.c4fb.2e74 843d.c673.10d0 default location 192.168.202.105 Downloading
遇到该问题AP日志会出现类似如下错误：
在 SHA-1 AP（2014 年年中之前制造）上：
*Dec 6 21:35:24.259: Using SHA-1 signed certificate for image signing validation.
*Dec 6 21:35:24.327: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: XX) has expired. Validity period ended on 21:37:36 UTC Dec 4 2022
*Dec 6 21:35:24.327: Image signing certificate validation failed (1A).
*Dec 6 21:35:24.327: Failed to validate signature
*Dec 6 21:35:24.327: Digital Signature Failed Validation (flash:/update/ap3g2-k9w8-mx.153-3.JPJ9/final_hash)
*Dec 6 21:35:24.327: AP image integrity check FAILED
在 SHA-2 AP（2014 年年中之后制造）上：
*Dec 6 08:47:20.159: Using SHA-2 signed certificate for image signing validation.
*Dec 6 08:47:20.223: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_record.c:169 Pkt too old last_seq_num : 11116,Received sequence num: 1 distance: -11115
*Dec 6 08:47:20.227: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: XX) has expired. Validity period ended on 21:43:46 UTC Dec 4 2022
*Dec 6 08:47:20.227: Image signing certificate validation failed (1A).
*Dec 6 08:47:20.231: Failed to validate signature
*Dec 6 08:47:20.231: Digital Signature Failed Validation (flash:/update/ap3g2-k9w8-mx.153-3.JPJ7c/final_hash)
*Dec 6 08:47:20.231: AP image integrity check FAILED
解决方法
如果您没有运行修复软件，请按照以下步骤允许 IOS AP 加入。
禁用 NTP，以防止控制器自动将其时间向前设置。
AireOS:
(AireOS WLC)>show time
make a note of all configured NTP servers, and delete each one:
(AireOS WLC)>config time ntp delete <INDEX_Number>
IOS-XE:
C9800#show run | i ntp
ntp server ip <NTP_SERVER_IP1>
C9800#config terminal
(config)#no ntp server ip <NTP_SERVER_IP1> ! for each configured NTP server
(AireOS WLC)> config time manual 12/02/22 00:00:00
C9800#clock set 00:00:00 2 Dec 2022
验证 WLC 上的时间是否已更改
(AireOS WLC)> show time
Time............................................. Fri Dec 2 00:00:02 2022
C9800#show clock
00:00:02.573 <TIMEZONE> Fri Dec 2 2022
