certificate resets itself (M281fdw)

[gegopaps]

Hello everyone,

I have an M281fdw (HP Color Laser Jet MFP) which excibits the following strange problem. It will randomly delete its installed SSL/TLS certificate and re-set it back to a self-signed certificate.

Under: Networking -> Certificates, I installed my CA certificate & printer certificate. Once installed I can connect via HTTPS and I verify that the certificate is correctly installed. HTTPS enforcement is enabled. Its connected via ethernet cable, DHCP is in use. WiFI and IPv6 are both disabled.

Wait a few days, connect via HTTPS to the printer and I immediately get the usual security warning about an untrusted certificate.

This is a new printer, installed a few weeks ago, the firmware is reported as:

Firmware Datecode: 20171210

Everything else seems to be working fine, no other settings are affected, only the printer certificate is being reset.

Please help.

Thank you.

[John_Getzke]

20171210 is the most current Firmware as of this point in time.  Normally I'd suggest updating the firmware for something like this.

Since this is a new printer then the next best steps might be to open a call with HP support and leverage your new printer warranty.  A problem like this will likely require a firmware update to resolve anyways so working direct with HP is the best way to accomplish that goal.

If you want to do a little more work before contacting HP then I would suggest some isolation testing.  See if the printer resets when connected to your network or not.  It could be recieving some kind wierd network message that forces it to reset its cert.  Disconnecting from the network may allow the printer to hold onto the cert for longer and give you some clues on where to go next.

If the printer drops the cert no mater the connection status then it is almost certainly a firmware bug that needs to be resolved by HP.  Actually, leaving it disconnected from everything but powered on for a few days is a great way to verify its a firmware issue as nothing else should be influencing the printer in this state.  

[gegopaps]

Thank you for your prompt and detailed reply.

The last thing I'm going to do, is contact HP support. In my experience that is a waste of time, I'll be transferred from one clueless person to the next and eventually nothing will happen, chances are they will have no idea what a PKCS#12 certificate is...

I did some investigation before posting. All printing services are disabled except 9100 printing. A quick port scan reveals a bunch of other open ports related to SOAP services. Hopefuly nothing on my local network is messing with those ports, but it should be fairly easy to block them with the internal printer firewall.

Your suggestion to keep the printer disconnected is a good one, I'll give that a go and see what happens.

Thanks!

[John_Getzke]

I would skip trying to explain the finer technical details with the 1st tier HP phone reps.  They dont need to know specifically what  PKCS#12 cert is to report a problem and escalate it onto engineering for a fix.  

What is important is that you are configuring a setting on the printer and the printer is forgetting/resetting that setting a few days later.  That is crux of the problem and should be easy for the 1st level reps to understand.  Wait for them to ask for the finer technical details until later so they are not distracted from the primary objective of the call.

Still there is mertit with our disconnected experiment.  Anything you can do to isolate the problem before calling HP will increase your chances of success.  Hopefully we can isolate it down to somethign like "when X feature is on then the printer behaves Y, is that by design or a firmware bug?".

[gegopaps]

I'm back after the experiment. Apparently, its a problem with the firmware, since the printer reset the certificate while it was offline.

I am not sure if there is a specific event (cronjob or similar) that causes this problem, from the outside it seems random, the only sure thing is that the certificate is reset in less than 24 hours.

In my experience its not worth trying to report these problems. Usually, the dev team that wrote the firmware is not even part of HP, since these embedded components are shared between companies (Samsung/Xerox, etc),  HP may not even have access to the real dev team. Other times the dev team is outsourced and once their contract is over there is no more support, its cheaper to just ignore the bugs and correct them in the next printer model.

Thanks for your time!

[John_Getzke]

The M281 is the current entry multifunction color laserjet printer model.  It is likely that HP still has access to the resources to make a change to the firmware.  If someone were going to report a bug like this then now would be the best time to do so.  Security is often the only reason that firmware is released for many models and I would consider something like this a security issue.

Still, if you are satisfied with the result then please mark one of the posts here as the solution.  It may help future readers confirm the same limitation save time troubleshooting the issue.  Choosing to ignore a bug may not be the solution you wanted, but it is still an solution.

If you do decide to contact HP then write back and let us know what you were able to discover.

[gegopaps · Accepted solution]

Firmware bug, printer resets the certificate at random intervals.

Quick solution: ignore the problem and just accept whatever garbage self-signed certificate is generated by the printer.

Long solution: contact HP support and good luck 🙂