Driverless printing not working due expiration of printer's certificate

[jph76]

Describe the bug Driverless printing doesn’t work with a HP LaserJet Pro MFP M227 sdn. This is a wired networked laser printer.

To Reproduce Steps to reproduce the behavior:

1. Go to CUPS web UI printer administration.
2. Ask CUPS to print a test page.
3. Printer will show as “stopped“ in CUPS web UI.
4. Print job will show as “held back“.

Expected behavior I expect the printer to print a test page.

Printing from computer using any application doesn’t work either and results in stopped queue.

Printing will work when adding the printer as a permanent queue using IPP everywhere.

Screenshots

Stopped printer:

System Information:

• OS and its version: Debian 12 amd64
• Application: any
• CUPS version: 2.4.2-3

Additional context Follow the instructions from the REPORTING-ISSUES document and provide all information regarding the issue.

Before printing:

jan@ugly:~$ lpstat -e
HP_LaserJet_MFP_M227sdn_F258AB
jan@ugly:~$ lpoptions -p HP_LaserJet_MFP_M227sdn_F258AB
device-uri=ipps://HP%20LaserJet%20MFP%20M227sdn%20(F258AB)._ipps._tcp.local/ printer-info='HP LaserJet MFP M227sdn (F258AB)' printer-location=Arbeitszimmer printer-make-and-model='HP HP LaserJet MFP M227-M231' printer-type=83890196

After printing:

root@ugly:~# lpstat -t
Zeitplandienst läuft
keine systemvoreingestellten Ziele
Gerät für HP_LaserJet_MFP_M227sdn_F258AB: implicitclass://HP_LaserJet_MFP_M227sdn_F258AB/
HP_LaserJet_MFP_M227sdn_F258AB akzeptiert Anfragen seit Do 13 Jul 2023 22:18:50 CEST
Drucker HP_LaserJet_MFP_M227sdn_F258AB ist deaktiviert seit Do 13 Jul 2023 22:18:50 CEST -
    unbekannter Grund
HP_LaserJet_MFP_M227sdn_F258AB-22 jan               1024   Do 13 Jul 2023 22:18:46 CEST

root@ugly:~# lpinfo -v
network http
network https
network lpd
network ipp
network beh
file cups-brf:/
network ipps
network socket
serial serial:/dev/ttyS0?baud=115200
direct hp
direct parallel:/dev/lp0
direct hpfax
network dnssd://HP%20LaserJet%20MFP%20M227sdn%20(F258AB)._ipp._tcp.local/?uuid=564e4633-5231-3036-3438-f43909f258ab
network socket://192.168.10.38
network ipps://HP%20LaserJet%20MFP%20M227sdn%20(F258AB)._ipps._tcp.local/

Other files as requested by instructions:

attr.log network.pcap.zip (network is wired) log.txt (I had to restart CUPS during this analysis) error_log_15000.txt.zip (only last 15.000 lines—complete file is 2.5 GB)

[zdohnal]

Hi @jph76 !

Thank you for the provided data and following the document! It helps a lot!

I've checked the log which you posted - I see IPP backend complains about the certificate your printer sends (it is expired):

14052 D [13/Jul/2023:22:18:50 +0200] [Job 22] update_reasons(attr=0(), s=\"-cups-certificate-error\")
14053 d [13/Jul/2023:22:18:50 +0200] [Job 22] op=\'-\', new_reasons=1, state_reasons=1
14054 D [13/Jul/2023:22:18:50 +0200] [Job 22] Connection is encrypted.
14055 d [13/Jul/2023:22:18:50 +0200] cupsdDeleteTemporaryPrinters: Removing unused temporary printers
14056 d [13/Jul/2023:22:18:50 +0200] select_timeout: JobHistoryUpdate=0
14057 D [13/Jul/2023:22:18:50 +0200] [Job 22] Credentials are expired (Berechtigung ist abgelaufen)
14058 D [13/Jul/2023:22:18:50 +0200] [Job 22] Printer credentials: NPIF258AB.fritz.box (issued by HP) / Mon, 30 Jan 2023 08:31:00 GMT / RSA-SHA256 / 5E0C3D07E76EE90AEBB47E1290698D15
14059 d [13/Jul/2023:22:18:50 +0200] cupsdDeleteTemporaryPrinters: Removing unused temporary printers
14060 d [13/Jul/2023:22:18:50 +0200] select_timeout: JobHistoryUpdate=0
14061 D [13/Jul/2023:22:18:50 +0200] [Job 22] No stored credentials.
14062 D [13/Jul/2023:22:18:50 +0200] [Job 22] update_reasons(attr=0(), s=\"-cups-pki-invalid,cups-pki-changed,cups-pki-expired,cups-pki-unknown\")
14063 d [13/Jul/2023:22:18:50 +0200] [Job 22] op=\'-\', new_reasons=4, state_reasons=1
14064 D [13/Jul/2023:22:18:50 +0200] [Job 22] update_reasons(attr=0(), s=\"+cups-pki-expired\")
14065 d [13/Jul/2023:22:18:50 +0200] [Job 22] op=\'+\', new_reasons=1, state_reasons=1
14066 D [13/Jul/2023:22:18:50 +0200] [Job 22] STATE: +cups-pki-expired

I've googled a little and it looks some HP printers are capable of changing/removing its certificates - https://h30434.www3.hp.com/t5/Printer-Setup-Software-Drivers/Expiring-Self-Signed-Certificate/td-p/6613719 - maybe you can find something similar in your printer's manual or on its web interface (you can access it by using printer's IP in the browser).

Otherwise if you are not able to change it, you can set AllowExpiredCerts Yes in /etc/cups/client.conf or via CUPS_EXPIREDCERTS env variable, or switch to plain IPP if it is fine for you.

Since I don't see the IPP Everywhere queue in lpstat output or in logs and you mentioned the printer works with IPP Everywhere model, I can't say for sure, but my guess is the IPP Everywhere queue was installed as a plain IPP, so the IPP backend does not ask about certificates, where the print queue generated by cups-browsed uses IPPS.

[jph76]

Hi @zdohnal , thank you for your assistance! I renewed the printer’s certificate as you suggested and now printing works. Is there a FAQ I missed reading?

Regarding the manual IPP Everywhere queue you didn't see: I removed it prior to my analysis to not mix up the queues. Now I won’t even bother re-creating it. :smile:

Have a nice weekend! :beers: