AP image integrity check FAILED

#说明

该Blog是针对于AireOS下的AP在更新image的时候，出现的问题，在其他较老的AP遇到类似的问题时，可能同样适用！

#型号

• WLC5508
• AP1602
• software:from 8.5.182 to 8.3.143

#涉及操作

将WLC5508从软件版本8.5.182降级到8.3.143；

通过predownload方式下载AP镜像失败；

重启WLC，AP再次注册WLC同步镜像失败；

#关键错误

AP在从WLC同步完image，解压的过程中报错：

extracting ap1g2-k9w8-mx.153-3.JD16/img_sign_rel.cert (1375 bytes)
extracting info.ver (291 bytes)!
*Oct 25 11:00:00.681: Currently running a Release Image

*Oct 25 11:00:00.777: Using SHA-2 signed certificate for image signing validation.
*Oct 25 11:00:00.861: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed.  The certificate (SN: 4E78A210000000000007) has expired.    Validity period ended on 21:43:46 UTC Dec 4 2022
*Oct 25 11:00:00.861: Image signing certificate validation failed (1A).

*Oct 25 11:00:00.861: Failed to validate signature
*Oct 25 11:00:00.861: Digital Signature Failed Validation (flash:/update/ap1g2-k9w8-mx.153-3.JD16/final_hash)
*Oct 25 11:00:00.861: AP image integrity check FAILED
Aborting Image Download


*Oct 25 11:00:02.673: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_record.c:169 Pkt too old last_seq_num : 10109,Received sequence num: 1 distance: -10108

比较关键的信息可以看到：

• 证书链验证失败
• 证书（SN：4E78A210000000000007）已过期。 有效期截止于 2022 年 12 月 4 日 21:43:46 UTC
• 验证签名失败
• AP 镜像完整性检查失败

#解决方法

通过基本信息查看，WLC的系统时间为2023年，显然是超过了有效期的范围，而LAP同步WLC的时间，也是2023年，那么我们需要将WLC的时间调整到有效期之前。

(Cisco Controller) >config time manual 10/10/22 10:10:10


(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >show time 

Time............................................. Mon Oct 10 10:10:12 2022

Timezone delta................................... 0:0
Timezone location................................ 

NTP Servers
    NTP Polling Interval.........................     600

     Index     NTP Key Index                  NTP Server                Status          NTP Msg Auth Status
    -------  ----------------------------------------------------------------------------------------------

调整之后查看AP的时间同步，再次下载镜像解压完成，完成注册和镜像同步。

APa0ec.xxx1.xxx5#sho clock
*10:25:18.203 UTC Mon Oct 10 2022
APa0ec.xxx1.xxx5#

extracting ap1g2-k9w8-mx.153-3.JD16/html/level/15/officeExtendapEvent.shtml.gz (988 bytes)!
extracting ap1g2-k9w8-mx.153-3.JD16/img_sign_rel.cert (1375 bytes)
extracting info.ver (291 bytes)!
*Oct 10 10:14:58.085: Currently running a Release Image

*Oct 10 10:14:58.181: Using SHA-2 signed certificate for image signing validation.
*Oct 10 10:14:58.265: Image signing certificate validation succeeded.

*Oct 10 10:14:59.941: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_record.c:169 Pkt too old last_seq_num : 10109,Received sequence num: 1 distance: -10108
Deleting current version: flash:/ap1g2-k9w8-mx.153-3.JF15...
Set booting path to recovery image: ''...
*Oct 10 10:15:06.901: AP image integrity check PASSED

done.
New software image installed in flash:/ap1g2-k9w8-mx.153-3.JD16
Configuring system to use new image...done.
archive download: takes 229 seconds

ReIniting the reap config file flash:/lwapp_reap.cfg
Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
Writing out the event log to flash:/event.log ...

*Oct 10 10:15:24.793: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.123.123.5:5246
*Oct 10 10:15:25.701:  Image upgrade successfully, system is now reloading
*Oct 10 10:15:25.773: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to the reason code 11
*Oct 10 10:15:25.773: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio1 due to the reason code 11
*Oct 10 10:15:25.801: %SYS-5-RELOAD: Reload requested by capwap image download proc. Reload Reason: NEW IMAGE DOWNLOAD.
*Oct 10 10:15:26.061: %LWAPP-5-CHANGED: CAPWAP changed state to DOWN

#参考文档

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html