2700 AP stuck "downloading" loop on C9800 WLC

[Charlie Grey]

hi,

2700 AP forever stuck downloading..

C9800 WLC is on 17.3.x software.

below are the logs. think is the MIC on the AP expired.

Any advise?

extracting ap3g2-k9w8-mx.153-3.JPJ9/R2.bin (15184 bytes)!!
extracting info.ver (291 bytes)
*Dec 7 03:11:22.359: Currently running a Release Image

*Dec 7 03:11:22.379: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_record.c:169 Pkt too old last_seq_num : 11109,Received sequence num: 1 distance: -11108
*Dec 7 03:11:22.383: Using SHA-2 signed certificate for image signing validation.
*Dec 7 03:11:22.451: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 4E78A210000000000007) has expired. Validity period ended on 21:43:46 UTC Dec 4 2022
*Dec 7 03:11:22.451: Image signing certificate validation failed (1A).

*Dec 7 03:11:22.455: Failed to validate signature
*Dec 7 03:11:22.455: Digital Signature Failed Validation (flash:/update/ap3g2-k9w8-mx.153-3.JPJ9/final_hash)
*Dec 7 03:11:22.455: AP image integrity check FAILED
Aborting Image Download

Download image failed, notify controller!!! From:8.5.151.0 to 17.3.6.76, FailureCode:3

[Arshad Safrulla]

This is a known ongoing issue for Cisco for now, I am not sure any FN or bug has been created by Cisco. Advise given to us was to stop all the WLC upgrades whatever the code until further notice only if you have any WAVE1. (X700 series APs)

Fix is change the time, you may have yo rewind it by couple of years. Reach out to TAC for further assistance

[Karsten Iwen · Accepted solution]

CSCwd80290, there should be a Field Notice soon.

[Karsten Iwen · Accepted solution]

https://www.cisco.com/c/en/us/support/docs/wireless/aironet-700-series-access-points/218447-ios-ap-image-download-fails-due-to-expir.html

[jtrombley]

Wow, I have been banging my head on a wall trying to get an AP added to our WLC since 12/6 (the same day as the bug).  Re-image the AP, factory reset, converted to Auto mode and back to Lightweight.  Then I noticed the cert error on the console log.  Google brought me here.  Reset time to Jan 2022 and the AP joined!  Thanks for posting this question and thanks for the work-around!  Now I have a couple of days to catch up on...