AP( AIR 1242AG-A-K9) suddenly stopped working and we are getting error "Invalid event 38 & state 3"

[NSG Manager]

Hi team,

AP suddenly stopped working . It currently shows RED color in status LED. All other APs are working fine . We have changed POE switch port but still issue persists.  We have other 31 Cisco APs which are working the same way it is working ( lightweight ) , switch port configuration for all APs are same . Please help us on this issue .

error logs

***********

*Jan 16 07:05:39.119: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROLLER
*Jan 16 07:05:49.120: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Jan 16 07:07:59.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.11.225 peer_port: 5246
*Jan 16 07:08:00.637: %DTLS-5-ALERT: Received FATAL : Certificate unknown alert from 192.168.11.225
*Jan 16 07:08:00.637: %CAPWAP-3-ERRORLOG: Bad certificate alert received from peer.
*Jan 16 07:08:00.637: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.11.225:5246
*Jan 16 07:08:00.638: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.
*Jan 16 07:09:03.999: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Jan 16 07:07:59.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.11.225 peer_port: 5246
*Jan 16 07:08:00.630: %DTLS-5-ALERT: Received FATAL : Certificate unknown alert from 192.168.11.225
*Jan 16 07:08:00.630: %CAPWAP-3-ERRORLOG: Bad certificate alert received from peer.
*Jan 16 07:08:00.631: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.11.225:5246
*Jan 16 07:08:00.632: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.

in WLC, SSC and MIC already enabled.

[Leo Laohoo]

*Jan 16 07:08:00.630: %DTLS-5-ALERT: Received FATAL : Certificate unknown alert from 192.168.11.225
*Jan 16 07:08:00.630: %CAPWAP-3-ERRORLOG: Bad certificate alert received from peer.

Post the complete output to the following commands: 

1.  WLC:  sh sysinfo; 

2.  AP:  sh inventory

I suspect the certificate in the AP has expired.

[NSG Manager]

Hi,

is there any fix to this issue.

A-AP#sho inventory
NAME: "AP1240", DESCR: "Cisco Aironet 1240 Series (IEEE 802.11a/g) Access Point"
PID: AIR-AP1242AG-A-K9 , VID: V01, SN: FHK104540F9

[Scott Fella]

If you followed the link and the certificate is fine, then maybe the AP is bad. You can probably find the same model pretty cheap online. 

-Scott 

*** Please rate helpful posts *** 

[Leo Laohoo]

FHK104540F9

Serial number tells me the AP was manufactured back in 2006.  So this means the certificate has expired.

[Scott Fella]

Just to add. These AP's are old so the certificate might be expired. Take a look at this link also:

https://supportforums.cisco.com/document/12453081/lightweight-ap-fail-create-capwaplwapp-connection-due-certificate-expiration

-Scott 

*** Please rate helpful posts *** 

[NSG Manager]

Hi, that was very helpful in identifying the issue, thanks.