Field Notice: FN72524 - During Software Upgrade/Downgrade, Cisco IOS APs Might Remain in Downloading State After December 4, 2022 Due to Certificate Expiration - Software Upgrade Recommended

Available Languages

Updated:December 7, 2023
Document ID:FN72524

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Products Affected


Affected Software Product Affected Release Affected Release Number Comments
IOS Software 15.3 15.3(3)JA1, 15.3(3)JA10, 15.3(3)JA11, 15.3(3)JA12, 15.3(3)JA1m, 15.3(3)JA4, 15.3(3)JA5, 15.3(3)JA7, 15.3(3)JA8, 15.3(3)JA9, 15.3(3)JAA, 15.3(3)JAB, 15.3(3)JAX, 15.3(3)JAX1, 15.3(3)JAX2, 15.3(3)JB, 15.3(3)JBB, 15.3(3)JBB1, 15.3(3)JBB2, 15.3(3)JBB4, 15.3(3)JBB5, 15.3(3)JBB6, 15.3(3)JC, 15.3(3)JC1, 15.3(3)JC14, 15.3(3)JC15, 15.3(3)JC2, 15.3(3)JC3, 15.3(3)JC4, 15.3(3)JC5, 15.3(3)JC50, 15.3(3)JC6, 15.3(3)JC7, 15.3(3)JC8, 15.3(3)JC9, 15.3(3)JD, 15.3(3)JD11, 15.3(3)JD12, 15.3(3)JD13, 15.3(3)JD14, 15.3(3)JD16, 15.3(3)JD17, 15.3(3)JD2, 15.3(3)JD3, 15.3(3)JD4, 15.3(3)JD5, 15.3(3)JD6, 15.3(3)JD7, 15.3(3)JD8, 15.3(3)JD9, 15.3(3)JDA17, 15.3(3)JE, 15.3(3)JF, 15.3(3)JF1, 15.3(3)JF10, 15.3(3)JF11, 15.3(3)JF12, 15.3(3)JF12i, 15.3(3)JF14, 15.3(3)JF14i, 15.3(3)JF15, 15.3(3)JF4, 15.3(3)JF5, 15.3(3)JF7, 15.3(3)JF8, 15.3(3)JF9, 15.3(3)JG1, 15.3(3)JH, 15.3(3)JH1, 15.3(3)JI1, 15.3(3)JI3, 15.3(3)JI4, 15.3(3)JI5, 15.3(3)JI6, 15.3(3)JJ, 15.3(3)JJ1, 15.3(3)JK, 15.3(3)JK1, 15.3(3)JK1t, 15.3(3)JK2, 15.3(3)JK2a, 15.3(3)JK3, 15.3(3)JK4, 15.3(3)JK5, 15.3(3)JK6, 15.3(3)JK7, 15.3(3)JK8, 15.3(3)JK8a, 15.3(3)JPI1, 15.3(3)JPI10, 15.3(3)JPI1t, 15.3(3)JPI4, 15.3(3)JPI5, 15.3(3)JPI6a, 15.3(3)JPI7, 15.3(3)JPI8a, 15.3(3)JPI9, 15.3(3)JPJ2, 15.3(3)JPJ2t, 15.3(3)JPJ3, 15.3(3)JPJ3a, 15.3(3)JPJ4, 15.3(3)JPJ5, 15.3(3)JPJ6, 15.3(3)JPJ7, 15.3(3)JPJ7c, 15.3(3)JPJ8a, 15.3(3)JPJ9, 15.3(3)JPK, 15.3(3)JPK1, 15.3(3)JPK2, 15.3(3)JPK3, 15.3(3)JPK4, 15.3(3)JPK5, 15.3(3)JPL, 15.3(3)JPM, 15.3(3)JPN, 15.3(3)JPN1, 15.3(3)JPO  
IOS XE Software 16 16.1.0, 16.1.1, 16.1.2, 16.1.3, 16.10.1, 16.10.1e, 16.11.1b, 16.11.1c, 16.12.1, 16.12.1s, 16.12.1t, 16.12.2, 16.12.2s, 16.12.3, 16.12.4, 16.12.4a, 16.12.5, 16.12.6a, 16.12.7, 16.12.8, 16.2.1, 16.2.2, 16.3.1, 16.3.10, 16.3.11, 16.3.1a, 16.3.2, 16.3.3, 16.3.3a, 16.3.4, 16.3.5, 16.3.5a, 16.3.5b, 16.3.5c, 16.3.6, 16.3.7, 16.3.8, 16.3.9  
IOS XE Software 17 17.1.1, 17.1.1a, 17.1.1s, 17.1.1t, 17.10.1, 17.2.1a, 17.3.1, 17.3.2a, 17.3.3, 17.3.4, 17.3.4c, 17.3.5a, 17.3.5b, 17.3.6, 17.4.1, 17.5.1, 17.6.1, 17.6.2, 17.6.3, 17.6.4, 17.7.1, 17.8.1, 17.9.1, 17.9.1a, 17.9.2  
IOS XE Software 3 3.6.0aE, 3.6.0bE, 3.6.0E, 3.6.10E, 3.6.1E, 3.6.2aE, 3.6.3E, 3.6.4E, 3.6.5aE, 3.6.5bE, 3.6.5E, 3.6.6E, 3.6.7aE, 3.6.7bE, 3.6.7E, 3.6.8E, 3.6.9aE, 3.6.9E, 3.7.0E, 3.7.1E, 3.7.2E, 3.7.3E, 3.7.4E, 3.7.5E  
Wireless LAN Controller Software 8.0 8.0.100.0, 8.0.104.0, 8.0.110.0, 8.0.115.0, 8.0.116.0, 8.0.120.0, 8.0.121.0, 8.0.132.0, 8.0.133.0, 8.0.135.0, 8.0.140.0, 8.0.150.0, 8.0.152.0  
Wireless LAN Controller Software 8.1 8.1.101.0, 8.1.102.0, 8.1.111.0, 8.1.120.0, 8.1.121.0, 8.1.122.0, 8.1.131.0, 8.1.132.0  
Wireless LAN Controller Software 8.10 8.10.105.0, 8.10.112.0, 8.10.113.0, 8.10.121.0, 8.10.122.0, 8.10.130.0, 8.10.142.0, 8.10.151.0, 8.10.162.0, 8.10.171.0, 8.10.181.0, 8.10.182.0  
Wireless LAN Controller Software 8.2 8.2.100.0, 8.2.110.0, 8.2.111.0, 8.2.121.0, 8.2.130.0, 8.2.141.0, 8.2.151.0, 8.2.160.0, 8.2.161.0, 8.2.164.0, 8.2.166.0, 8.2.170.0  
Wireless LAN Controller Software 8.3 8.3.102.0, 8.3.108.0, 8.3.111.0, 8.3.112.0, 8.3.121.0, 8.3.122.0, 8.3.130.0, 8.3.131.0, 8.3.132.0, 8.3.133.0, 8.3.135.0, 8.3.140.0, 8.3.141.0, 8.3.143.0, 8.3.150.0  
Wireless LAN Controller Software 8.4 8.4.100.0  
Wireless LAN Controller Software 8.5 8.5.103.0, 8.5.105.0, 8.5.108.0, 8.5.109.0, 8.5.110.0, 8.5.120.0, 8.5.131.0, 8.5.135.0, 8.5.140.0, 8.5.151.0, 8.5.160.0, 8.5.161.0, 8.5.171.0, 8.5.182.0, 8.5IRCM  
Wireless LAN Controller Software 8.6 8.6.101.0  
Wireless LAN Controller Software 8.7 8.7.102.0, 8.7.106.0  
Wireless LAN Controller Software 8.8 8.8.100.0, 8.8.111.0, 8.8.120.0, 8.8.125.0, 8.8.130.0  
Wireless LAN Controller Software 8.9 8.9.100.0, 8.9.111.0  

Defect Information


Defect IDHeadline
CSCwd80290Cisco IOS AP image validation certificate failed/expired, causing AP join issues.

Problem Description


Cisco IOS®-based Access Points (APs) that use expired certificates for image validation as of December 5, 2022 could cause Cisco IOS AP image downloads from a Wireless LAN Controller (WLC) to fail, which prevents the AP from joining the controller.

This affects all Cisco lightweight APs that run Cisco IOS, which include: 802.11ac Wave 1 APs (IW3702/3700/2700/1700/1570 series) and earlier APs including 700/1530/1550/3600/2600/1600/3500/AP802/AP803 series. The affected lightweight Cisco IOS images were built from December 2012 through November 2022. 


Background


Cisco IOS-based APs use a certificate to validate the software image that has been downloaded and installed from the controller before installing that software on the AP. Because this certificate expired on December 5, 2022, validation will fail and the AP will not install the newly downloaded image. The AP will continue to try to download and validate this image, and will continue to fail indefinitely until a workaround or solution is applied.

Cisco Aironet 802.11ac Wave 2 and Catalyst Wi-Fi6/6E Access Point and later APs are not affected by this issue.

For more detail, see IOS AP Image Download Fails Due to Expired Image Signing Certificate Post December 4th, 2022 (CSCwd80290).


Problem Symptom


Affected APs will remain in the downloading state and never complete their join to the WLC. For a more detailed description of the symptom, see IOS AP Image Download Fails Due to Expired Image Signing Certificate Post December 4th, 2022 (CSCwd80290).


Workaround/Solution


This issue does not require hardware replacement.

Solution

Upgrade your WLC to one of the versions in the "Upgrading to Fixed Software" section in IOS AP Image Download Fails Due to Expired Image Signing Certificate Post December 4th, 2022 (CSCwd80290).

Workaround

For any WLC that has APs stuck in the downloading state:

  • Disable Network Time Protocol (NTP) on the WLC and manually set the WLC date/time to a date before December 2, 2022. The Cisco IOS AP will then be able to download and validate the image, install the new image, and join the controller. Once the AP has joined the controller, NTP can be re-enabled on the controller to assume the correct date and time.
  • Customers who receive a replacement Cisco IOS-based AP(s) from Cisco via Return Material Authorization (RMA)/Warranty and have not upgraded their WLC(s) to a fixed software version should go through this workaround. For more details, see IOS AP Image Download Fails Due to Expired Image Signing Certificate Post December 4th, 2022 (CSCwd80290).

For More Information


These AP series are affected:

  • Cisco Aironet 3700 Series Access Points
  • Cisco Aironet 2700 Series Access Points
  • Cisco Aironet 1700 Series Access Points
  • Cisco Industrial Wireless 3700 Series
  • Cisco Aironet 1570 Series Access Points
  • Cisco Aironet 3600 Series Access Points
  • Cisco Aironet 3500 Series Access Points
  • Cisco Aironet 2600 Series Access Points
  • Cisco Aironet 1600 Series Access Points
  • Cisco Aironet 700 Series Access Points
  • Cisco Aironet 1530 Series Access Points
  • Cisco Aironet 1550 Series Access Points
  • Cisco 800 and 1900 Series ISR Integrated Access Points

These WLCs are affected, only if they control affected Cisco IOS APs:

AireOS Controllers

  • Cisco Virtual Wireless Controller
  • Cisco 8500 Series Wireless Controllers
  • Cisco 5500 Series Wireless Controllers
  • Cisco 3500 Series Wireless Controllers
  • Cisco 2500 Series Wireless Controllers
  • Cisco Flex 7500 Series Wireless LAN Controllers

Converged Access Cisco IOS XE Controllers

  • Cisco 5700 Series Wireless LAN Controllers
  • Cisco Catalyst 3850 Series Switches
  • Cisco Catalyst 3650 Series Switches

Cisco IOS XE Controllers

  • Cisco Catalyst 9800 Wireless Controllers for Cloud
  • Cisco Catalyst 9800 Series Wireless Controller

Cisco IOS XE Switches with Embedded Wireless Controllers

  • Cisco Catalyst 9300 Series Switches
  • Cisco Catalyst 9300L Series Switches
  • Cisco Catalyst 9400 Series Switches
  • Cisco Catalyst 9400 Supervisor Engine
  • Cisco Catalyst 9500 Series Switches

Revision History


VersionDescriptionSectionDate
1.4Updated formatting to have tabs for each section.Products Affected, Problem Description, Problem Symptom, Workaround/Solution2023-DEC-07
1.3Updated the Workaround/Solution Section—2022-DEC-21
1.2Updated Recommended Action, Products Affected, MDF tags, Problem Description, Background, Problem Symptom, Workaround/Solution.—2022-DEC-16
1.0Initial Release—2022-DEC-08
1.1Updated the Product Tags—2022-DEC-08

For More Information

For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:

Receive Email Notification About New Field Notices

To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products