Error | Cause / Solution |
|---|---|
"SSL certificate problem: self signed certificate in certificate chain" | One of the situations that prevent a successful connection is not having the correct Certificate Authority certificates installed on the remote server. Zebra requires that the Zebra Root Certificate Authority and the Zebra Subordinate Certificate Authority be installed on the remote server. This error typically indicates that only one of the Zebra Certificate Authority certificates is installed on the remote server.
When using certificate files, the time on the printer must be set correctly for the websocket connection to succeed, as the time is used in the certificate validation. |
"SSL certificate problem: unable to get local issuer certificate" | One of the situations that prevent a successful connection is not having the correct Certificate Authority certificates installed on the remote server. Zebra requires that the Zebra Root Certificate Authority and the Zebra Subordinate Certificate Authority be installed on the remote server. This error typically indicates that neither of the Zebra Certificate Authority certificates are installed on the remote server.
When using certificate files, the time on the printer must be set correctly for the websocket connection to succeed, as the time is used in the certificate validation. |
"SSL certificate problem: certificate has expired" | This error indicates that the remote server’s certificate has expired. This is typically an indication that the printer’s date and/or time are incorrect as the Zebra certificates are typically issued for long durations. Check that rtc.date and rtc.time are set correctly.
For printers that do not have a battery to store the Real Time Clock (RTC) value, the date will be restored to the default value upon a power cycle. The default value depends upon how the rtc.date SGD is managed. If it has never been set then it will default to the firmware build date (the value in appl.date ). Otherwise, the value in rtc.date will default to the value that it was last set to. This does not mean the value of the rtc.date when it was power cycled. It means that when a user sets rtc.date that becomes the new default value. rtc.date is never default and continues to track the date as expected.
When using certificate files, the time on the printer must be set correctly for the websocket connection to succeed, as the time is used in the certificate validation. |
"SSL certificate problem: certificate is not yet valid" | This error indicates that the remote server’s certificate was incorrectly issued or that the printer’s date and/or time are incorrect. Check that the printer’s date and time ( rtc.date and rtc.time ) are set correctly and that the certificate’s start and expiration date are valid.
For printers that do not have a battery to store the Real Time Clock (RTC) value, the date will be restored to the default value upon a power cycle. The default value depends upon how the rtc.date SGD is managed. If it has never been set then it will default to the firmware build date (the value in appl.date ). Otherwise, the value in rtc.date will default to the value that it was last set to. This does not mean the value of the rtc.date when it was power cycled. It means that when a user sets rtc.date that becomes the new default value. rtc.date is never default and continues to track the date as expected. |
"subjectAltName does not match 1.2.3.4" | Part of the certificate validation process involves making sure that the remote server is who it claims to be. A certificate can be created to validate against several aliases/DNS names. Typically the certificate will not contain the IP address of the server as IP addresses are subject to change. When specifying the remote server’s URL via weblink.ip.conn1.location be sure to specify one of the DNS aliases listed in the certificate. The valid names will be listed either under the Common Name (CN) field and/or the subjectAltName (SAN or Subject Alternate Name) field within the certificate. For example, the certificate may have the CN set to 'examplecorpinc' and the SAN set to 'examplecorpinc.com' or 'alias.for.examplecorpinc.com' . Any of the CN or SAN names can be used, but, as the IP address is not listed in the CN or SAN it cannot. It is not recommended that the IP address be part of the SAN if a DNS name is available to avoid connection issues that may arise due to subnet change or DHCP lease expirations, etc.
When using certificate files, the time on the printer must be set correctly for the websocket connection to succeed, as the time is used in the certificate validation. |
"SSL certificate subject name 'examplecorpinc.com' does not match target host name '1.2.3.4'" | |
"Unknown SSL protocol error in connection to ...” | When this message is seen it means that the remote server’s SSL/TLS configuration is incorrect. Refer to Troubleshooting to ensure the server and printer are both configured correctly. |
I do not see any of these errors, but the printer still does not connect. | Refer to Troubleshooting to ensure the server and printer are both configured correctly. |
