AIR-CAP3502I-A-K9 | Mar 19 03:35:36.011: %PKI-3-CERTIFICATE_INVALID_EX

[Ibrahim Jamil]

Hi Guys

I m getting the Below for this AP Product/Model Number : AIR-CAP3502I-A-K9

it Does Works/Joined WLC after i changed the WLC-2504 clock time to 1 March 2022 but the Radio of the APs keeps up and Down , how to i fix that issue??

thanks

*Mar 19 03:35:22.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.105 peer_port: 5246
*Mar 19 03:35:36.011: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 4C977E00000008D0D0) has expired. Validity period ended on 01:01:55 UTC Mar 16 2022Peer certificate verification failed 001A

*Mar 19 03:35:36.011: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed!
*Mar 19 03:35:36.011: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.100.105:5246
*Mar 19 03:35:36.011: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.100.105:5246
*Mar 19 03:36:45.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.105 peer_port: 5246
*Mar 19 03:36:45.000: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_handshake.c:929 Unexpected message received while expecting HelloVerifyRequest
*Mar 19 03:36:45.000: %DTLS-5-SEND_ALERT: Send FATAL : Unexpected message Alert to 192.168.100.105:5246
*Mar 19 03:36:45.000: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.100.105:5246

User Access Verification

Username:
Username:
Password:
*Mar 19 03:37:50.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.105 peer_port: 5246
*Mar 19 03:37:52.000: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_handshake.c:929 Unexpected message received while expecting HelloVerifyRequest

*Mar 19 03:37:52.000: %DTLS-5-SEND_ALERT: Send FATAL : Unexpected message Alert to 192.168.100.105:5246
*Mar 19 03:37:52.000: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.100.105:5246
% Authentication failed

Username: Cisco
Password:

AP>
AP>
AP>
AP>
AP>
AP>
AP>en
Password:
% Access denied

AP>
Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)

*Mar 19 03:39:03.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.100.105 peer_port: 5246
*Mar 19 03:39:03.009: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 4C977E00000008D0D0) has expired. Validity period ended on 01:01:55 UTC Mar 16 2022Peer certificate verification failed 001A

*Mar 19 03:39:03.009: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed!
*Mar 19 03:39:03.009: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.100.105:5246
*Mar 19 03:39:03.009: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.100.105:5246
AP>
AP>

Product/Model Number : AIR-CAP3502I-A-K9

[Leo Laohoo]

Post the complete output to the WLC command of "sh sysinfo".

[Ibrahim Jamil]

Hello Leo

Here you go my freind

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.5.110.0
Bootloader Version............................... 1.0.16
Field Recovery Image Version..................... 1.0.0
Firmware Version................................. PIC 16.0

OUI File Last Update Time........................ Sun Sep 07 10:44:07 IST 2014

Build Type....................................... DATA + WPS

System Name...................................... WLC
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1279
IP Address....................................... 192.168.100.105
IPv6 Address..................................... ::
Last Reset....................................... Power on reset
System Up Time................................... 0 days 0 hrs 2 mins 35 secs

--More-- or (q)uit
System Timezone Location.........................
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

Configured Country............................... US - United States
Operating Environment............................ Commercial (0 to 40 C)
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +11 C
External Temperature............................. +15 C
Fan Status....................................... 3500 rpm

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 2
Number of Active Clients......................... 0

OUI Classification Failure Count................. 0

Burned-in MAC Address............................ 40:C4:AA:BB:CC:00
Maximum number of APs supported.................. 75
System Nas-Id....................................
WLC MIC Certificate Types........................ SHA1

[MHM Cisco World]

AP_CLI#show crypto pki certificates

CA Certificate

Status: Available...

...

Certificate

Status: Available

Certificate Serial Number: 728AF4350000001E4C89

Certificate Usage: General Purpose

Issuer:

cn=Cisco Manufacturing CA

o=Cisco Systems

Subject:

Name: C1130-001c58b5b3a4

ea=support@cisco.com

cn=C1130-001c58b5b3a4

o=Cisco Systems

l=San Jose

st=California

c=US

CRL Distribution Points:

http://www.cisco.com/security/crl/cmca.crl

Validity Date:

start date: 04:22:10 UTC Jul 11 2007

end date: 04:32:10 UTC Jul 11 2017

Associated Trustpoints: Cisco_IOS_MIC_cert

check the date if it end then, config NTP to be before that Date and it will join.
other workaround is 

config ap cert-expiry-ignore {mic|ssc} enable

[Ibrahim Jamil]

Hi MHM

I played with time to be 2 weeks Back , but the Wireless IP-Phone (7921) no longer able to register to CUCM 11.5 SU10 :((( coz AP Radio keeps up and down while AP joined the WLC

Thanks

[MHM Cisco World]

Did you try cert ignore?

[Leo Laohoo]

---

@Ibrahim Jamil wrote:

Product Version.................................. 8.5.110.0

---

Upgrade the firmware.  

[Ibrahim Jamil]

Hello leo My Freind

Shall i go with below version

AIR-CTVM-K9-8-10-171-0.aes

thanks

[Leo Laohoo]

---

@Ibrahim Jamil wrote:

Shall i go with below version AIR-CTVM-K9-8-10-171-0.aes

---

No because the last train to support 3500 is 8.5.X.X.  

[Rich R]

And make sure you have read and carefully followed all the steps in https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

Refer to https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html for latest build of AireOS you should be using subject to support for all your APs.

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html#ctr-ap_support

[Ibrahim Jamil]

Thanks rrudling