Cisco 2504 with Cisco 1242's and old certificates expiring

[bkastor]

I wasn't sure if I should add to:

 https://supportforums.cisco.com/document/12453081/lightweight-ap-fail-create-capwaplwapp-connection-due-certificate-expiration

...but I have this exact issue (pulling my hair out for a couple of hours, why isn't this AP joining this controller all of the sudden). 

My question is how to permanently fix this issue? 

I am following the fix (the workaround mentioned in the URL above) by turning off NTP and setting the time back to before the expiration (again, explained in the URL above).

The last part of the workaround is to run one of two commands (depends on which version you are running).

My problem is, I am running 8.0.115.0 and those commands at the CLI are not available to me. 

I am hoping it is somewhere in the GUI for the 2504?.. or that someone knows what CLI commands are equivalent to the URL above. 

Thanks!

For reference.. and anybody else ripping their hair out, here were the pertinent log messages that got me here:

%CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 1.1.1.1 peer_port: 5246
%DTLS-5-ALERT: Received FATAL : Certificate unknown alert from 1.1.1.1
%CAPWAP-3-ERRORLOG: Bad certificate alert received from peer.
%DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 1.1.1.1:5246
%CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.

[Leo Laohoo · Accepted solution]

My question is how to permanently fix this issue? 

The permanent fix is NOT found in the firmware 8.0.115.0.  Try upgrading to 8.0.240.0.

[bkastor]

Thanks for the quick reply. I will upgrade and report back my findings. Thanks again!

[bkastor]

That was it! I could not find that image? I went with 8.0.121. Then the option (at the CLI) was there. Appreciate the nudge (I had the 8.0.121 downloaded for a while I guess.. just never got around to upgrading). After the upgrade I changed those values. I reset NTP (turned it back on) and then rebooted the AP. It is up and functioning. 

Thanks again!