[Help]: V6 - Unable to verify firmware and certificate issue #621

andrema2 · 2025-09-07T15:04:26Z

andrema2
Sep 7, 2025

Controller Version

V 6.0.0.19

Describe Your Issue or Question

Using the Beta6-openj9 I cannot check for the firmware it says Operation failed. Please check your network connection. The internet connection is working and the network of the docker is set as host. It's also no connected to the cloud per the Cloud Access status. Seems to me that it has to do with the certificate not being valid.

Expected Behavior

Being able to check the firmware and the cloud access to be connected

Steps to Reproduce

I duplicate the original folders from the latest version 5 (from today 09/07/2025), went through the upgrade processo of Mongo with no issues. Everything seems fine so far besides it

How You're Launching the Container

services:
  omada6:

    cap_drop:
      - "AUDIT_CONTROL"
      - "BLOCK_SUSPEND"
      - "DAC_READ_SEARCH"
      - "IPC_LOCK"
      - "IPC_OWNER"
      - "LEASE"
      - "LINUX_IMMUTABLE"
      - "MAC_ADMIN"
      - "MAC_OVERRIDE"
      - "NET_BROADCAST"
      - "SYSLOG"
      - "SYS_ADMIN"
      - "SYS_BOOT"
      - "SYS_MODULE"
      - "SYS_NICE"
      - "SYS_PACCT"
      - "SYS_PTRACE"
      - "SYS_RAWIO"
      - "SYS_RESOURCE"
      - "SYS_TIME"
      - "SYS_TTY_CONFIG"
      - "WAKE_ALARM"

    command:
      - "java"
      - "-server"
      - "-Xms128m"
      - "-Xmx1024m"
      - "-XX:MaxHeapFreeRatio=60"
      - "-XX:MinHeapFreeRatio=30"
      - "-XX:+HeapDumpOnOutOfMemoryError"
      - "-XX:HeapDumpPath=/opt/tplink/EAPController/logs/java_heapdump.hprof"
      - "-Djava.awt.headless=true"
      - "--add-opens"
      - "java.base/sun.security.x509=ALL-UNNAMED"
      - "--add-opens"
      - "java.base/sun.security.util=ALL-UNNAMED"
      - "-cp"
      - "/opt/tplink/EAPController/lib/*::/opt/tplink/EAPController/properties:"
      - "com.tplink.smb.omada.starter.OmadaLinuxMain"

    container_name: "omada6"

    entrypoint:
      - "/entrypoint.sh"

    environment:
      - "MANAGE_HTTP_PORT=8088"
      - "MANAGE_HTTPS_PORT=8043"
      - "PORTAL_HTTP_PORT=8088"
      - "PORTAL_HTTPS_PORT=8043"
      - "TZ=America/Sao_Paulo"
      - "PATH=/opt/java/openjdk/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      - "JAVA_HOME=/opt/java/openjdk"
      - "JAVA_TOOL_OPTIONS=-XX:+IgnoreUnrecognizedVMOptions -XX:+PortableSharedCache -XX:+IdleTuningGcOnIdle\
        \ -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Xtune:virtualized"

    expose:
      - "19810/udp"
      - "27001/udp"
      - "29810/udp"
      - "29811/tcp"
      - "29812/tcp"
      - "29813/tcp"
      - "29814/tcp"
      - "29815/tcp"
      - "29816/tcp"
      - "8043/tcp"
      - "8088/tcp"
      - "8843/tcp"

    hostname: "omada6"

    image: "mbentley/omada-controller:beta-6.0-openj9"

    ipc: "private"

    labels:
      com.docker.compose.config-hash: "48d13cfba1bb7646224d2df578ea7005635f586d807a4e7befd74cb2d25ca91a"
      com.docker.compose.container-number: "1"
      com.docker.compose.oneoff: "False"
      com.docker.compose.project: "omada2"
      com.docker.compose.project.config_files: "docker-compose.yml"
      com.docker.compose.project.working_dir: "/home/andre/stacks/omada2"
      com.docker.compose.service: "omada"
      com.docker.compose.version: "1.29.2"
      maintainer: "Matt Bentley <[email protected]>"
      org.opencontainers.image.source: "https://github.com/mbentley/docker-omada-controller"

    logging:
      driver: "json-file"
      options: {}

    network_mode: "host"

    volumes:
      - "/dockers/omada6/data:/opt/tplink/EAPController/data"
      - "/dockers/omada6/logs:/opt/tplink/EAPController/logs"
      - "/dockers/omada6/work:/opt/tplink/EAPController/work"

    working_dir: "/opt/tplink/EAPController/lib"

Container Logs

at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.executeChain(AdviceFilter.java:108) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:137) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:458) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:373) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90) [shiro-core-1.13.0.jar:1.13.0]
	at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83) [shiro-core-1.13.0.jar:1.13.0]
	at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387) [shiro-core-1.13.0.jar:1.13.0]
	at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:370) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:154) [shiro-web-1.13.0-jakarta.jar:1.13.0]
	at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:362) [spring-web-6.2.2.jar:6.2.2]
	at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:278) [spring-web-6.2.2.jar:6.2.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) [spring-web-6.2.2.jar:6.2.2]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.2.2.jar:6.2.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) [spring-web-6.2.2.jar:6.2.2]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.2.2.jar:6.2.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.springframework.web.filter.ServerHttpObservationFilter.doFilterInternal(ServerHttpObservationFilter.java:114) [spring-web-6.2.2.jar:6.2.2]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.2.2.jar:6.2.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) [spring-web-6.2.2.jar:6.2.2]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:116) [spring-web-6.2.2.jar:6.2.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:905) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) [tomcat-embed-core-10.1.39.jar:10.1.39]
	at java.base/java.lang.Thread.run(Unknown Source) [?:?]
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.Validator.validate(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ~[?:?]
	at com.tplink.eap.cloudsdk.a.checkServerTrusted(SourceFile:102) ~[cloudsdk-1.2.3.jar:?]
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source) ~[?:?]
	... 153 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) ~[?:?]
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) ~[?:?]
	at java.base/java.security.cert.CertPathBuilder.build(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.Validator.validate(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ~[?:?]
	at com.tplink.eap.cloudsdk.a.checkServerTrusted(SourceFile:102) ~[cloudsdk-1.2.3.jar:?]
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source) ~[?:?]
	... 153 more
09-07-2025 11:53:14.946 WARN [https-jsse-nio-8043-exec-3] [] c.t.s.o.m.c.f(): Failed to getBatchGetHighestFwChannels, req:OmadacModelFwInfo(oemId=v2#hzexF52bBKnww2A6iLMxsa8AJ2BqFejABBTmT2ShtBjV76t9UA+pB460JCDAOG7Q, hwId=v2#NdWarovCsHQ6GTHanawHGUY9RYkBpwe09Yutuvw2PZ+dlmmk8lg7/eZjwV28QM3x, compoundModel=EAP245(US) v3.0, showModel=EAP245(US) v3.0, version=5.2.0, firmwareVersion=5.2.0 Build 20240914 Rel. 59923, pro=false, siteIds=[677d3c443acb7f22140f09d7])
09-07-2025 11:53:14.946 WARN [https-jsse-nio-8043-exec-3] [] c.t.s.o.m.d.d.m.u.c.B(): get modelInfo failed by cloud, models:{v2#NdWarovCsHQ6GTHanawHGUY9RYkBpwe09Yutuvw2PZ+dlmmk8lg7/eZjwV28QM3xv2#hzexF52bBKnww2A6iLMxsa8AJ2BqFejABBTmT2ShtBjV76t9UA+pB460JCDAOG7Q=OmadacModelFwInfo(oemId=v2#hzexF52bBKnww2A6iLMxsa8AJ2BqFejABBTmT2ShtBjV76t9UA+pB460JCDAOG7Q, hwId=v2#NdWarovCsHQ6GTHanawHGUY9RYkBpwe09Yutuvw2PZ+dlmmk8lg7/eZjwV28QM3x, compoundModel=EAP245(US) v3.0, showModel=EAP245(US) v3.0, version=5.2.0, firmwareVersion=5.2.0 Build 20240914 Rel. 59923, pro=false, siteIds=[677d3c443acb7f22140f09d7]), v2#vMPJmAqK/1wRt4l9MMCbU2Nsw5SYT7WLNPkSnhgtp7XszsoR+gPouzZ92iHma/cIv2#MGYQaaOB6vaQz5TQNtOM6Kx8P+FJkmMf0FbioZtfGdY9yj1Owady7sKIDsH5gP9S=OmadacModelFwInfo(oemId=v2#MGYQaaOB6vaQz5TQNtOM6Kx8P+FJkmMf0FbioZtfGdY9yj1Owady7sKIDsH5gP9S, hwId=v2#vMPJmAqK/1wRt4l9MMCbU2Nsw5SYT7WLNPkSnhgtp7XszsoR+gPouzZ92iHma/cI, compoundModel=SG3428 v2.30, showModel=SG3428 v2.30, version=2.30.9, firmwareVersion=2.30.9 Build 20250628 Rel.73019, pro=false, siteIds=[677d3c443acb7f22140f09d7]), v2#8/LbHdxeBY1cVIUnzgWoDCfnlHaQt4MQB5qsIjqntxaMW1XM7aqYJVbbwl2qtd31v2#AM27zUYtz0vf5hl2om68AlxvKpxR9D5HxV6W39zljnAutpIp9j7TroJ/oYf2GnWO=OmadacModelFwInfo(oemId=v2#AM27zUYtz0vf5hl2om68AlxvKpxR9D5HxV6W39zljnAutpIp9j7TroJ/oYf2GnWO, hwId=v2#8/LbHdxeBY1cVIUnzgWoDCfnlHaQt4MQB5qsIjqntxaMW1XM7aqYJVbbwl2qtd31, compoundModel=EAP670(US) v1.0, showModel=EAP670(US) v1.0, version=1.1.1, firmwareVersion=1.1.1 Build 20250326 Rel. 61737, pro=false, siteIds=[677d3c443acb7f22140f09d7]), v2#LI0TvQ4OxQyeOHYA4Ct2EC/Z8iiDNCrPlf46yNiaU34nih6hDj1ebKNd5/YWkzIpv2#Vm+89wE4MIykitBdNsWot+7w2oPmhvswGpzIKOY3h0JwUmR9rfaB9SP7hhS3PblR=OmadacModelFwInfo(oemId=v2#Vm+89wE4MIykitBdNsWot+7w2oPmhvswGpzIKOY3h0JwUmR9rfaB9SP7hhS3PblR, hwId=v2#LI0TvQ4OxQyeOHYA4Ct2EC/Z8iiDNCrPlf46yNiaU34nih6hDj1ebKNd5/YWkzIp, compoundModel=T1500G-8T v2.0, showModel=T1500G-8T v2.0, version=2.0.6, firmwareVersion=2.0.6 Build 20200805 Rel.56922, pro=false, siteIds=[677d3c443acb7f22140f09d7])}
09-07-2025 11:53:16.075 INFO [https-jsse-nio-8043-exec-2] [] c.t.s.o.m.p.w.c.c.a(): End to getUserAvailableSites, cost 2, time 1757256796075
09-07-2025 11:53:19.838 INFO [https-jsse-nio-8043-exec-8] [] c.t.s.o.m.p.w.c.c.a(): End to getUserAvailableSites, cost 2, time 1757256799838
09-07-2025 11:53:20.987 WARN [https-jsse-nio-8043-exec-2] [] c.t.s.o.m.d.d.m.s.i(): OmadacId(b7a5f8b78a44a52ee1c24e3a228eb8ea) device host not enable
09-07-2025 11:54:42.385 INFO [Thread-9] [] c.t.e.c.c.q(): set connection status: CONNECTING
09-07-2025 11:54:42.668 INFO [Thread-9] [] c.t.e.c.c.q(): Exception occurs when connecting service server:javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
09-07-2025 11:54:42.668 INFO [Thread-9] [] c.t.e.c.c.q(): set connection status: DISCONNECTED_NORMAL
09-07-2025 11:54:47.654 INFO [comm-pool-14] [] c.t.s.o.m.d.a.u.f.d(): Target firmware check task run
09-07-2025 11:54:47.654 INFO [comm-pool-14] [] c.t.s.o.m.d.a.u.f.d(): no omadac need handle target firmware upgrade
09-07-2025 11:54:56.099 WARN [https-jsse-nio-8043-exec-2] [] c.t.s.o.m.d.d.m.s.i(): OmadacId(b7a5f8b78a44a52ee1c24e3a228eb8ea) device host not enable
09-07-2025 11:56:46.257 WARN [https-jsse-nio-8043-exec-5] [] c.t.s.o.m.d.d.m.s.i(): OmadacId(b7a5f8b78a44a52ee1c24e3a228eb8ea) device host not enable
09-07-2025 11:56:59.971 WARN [https-jsse-nio-8043-exec-9] [] c.t.s.o.m.d.d.m.s.i(): OmadacId(b7a5f8b78a44a52ee1c24e3a228eb8ea) device host not enable

MongoDB Logs

No response

Additional Context

No response

mbentley · 2025-09-07T19:53:22Z

mbentley
Sep 7, 2025
Maintainer

Hmm, I will probably need to get my test environment up and running to try to replicate this. I can see that the java root ca keystore has certs but I don't know exactly what's going on. Probably due to how I've installed openj9, the ca-certificates-java package isn't installed so maybe that is it. If you could try something, could you exec into the container and do:

apt-get  update
apt-get --no-install-recommends -y install ca-certificates-java

And then restart the container to see if you see any difference.

5 replies

mbentley Sep 7, 2025
Maintainer

Also, where are you triggering the firmware check? And are you just looking at the cloud configuration page under Settings > Cloud Access to see where it isn't connected?

mbentley Sep 7, 2025
Maintainer

I got my test environment up and running where I just have a single EAP (an EAP 225) and I was able to pull up the Global View > Firmware > One-Time Upgrade page and it was able to identify firmware so it seems that it was able to check. It did temporarily throw up an error message that I wasn't able to capture but when I checked the container logs, I had no errors and when I loaded the page again, it had the available firmware upgrade listed for my EAP 225.

When I check under Settings > System Settings and trigger a "Check for updates", it succeeds and returns a message: "Your Controller is currently up-to-date. Enjoy!"

I did also try to connect the controller to the TP-Link Cloud service and it succeeded.

Of course I did all of this on a clean controller install so I am not sure if that makes a difference or not.

mbentley Sep 7, 2025
Maintainer

@pjrobin-priv if you could take a look at this above and share some info about what you can do to help me try to reproduce this, that would be great. Also, let me know what tag you're using.

andrema2 Sep 7, 2025
Author

Also, where are you triggering the firmware check? And are you just looking at the cloud configuration page under Settings > Cloud Access to see where it isn't connected?

I'm checking at the Global view level. It's a menu option at the left.
Regarding the Cloud Access it shows at the Global level too, in the opening page.

I've tried the apt update and get commands you suggest and got this bellow
Setting up ca-certificates-java (20240118) ...
No JRE found. Skipping Java certificates setup.

mbentley Sep 8, 2025
Maintainer

@pjrobin-priv - could you check to see if the app works now? They said they might have fixed something on their side https://community.tp-link.com/en/business/forum/topic/840402?replyId=1606794

andrema2 · 2025-09-07T22:07:34Z

andrema2
Sep 7, 2025
Author

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source) ~[?:?]
	at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) ~[?:?]
	at java.base/java.security.cert.CertPathBuilder.build(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.PKIXValidator.doBuild(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.PKIXValidator.engineValidate(Unknown Source) ~[?:?]
	at java.base/sun.security.validator.Validator.validate(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source) ~[?:?]
	at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ~[?:?]
	at com.tplink.eap.cloudsdk.a.checkServerTrusted(SourceFile:102) ~[cloudsdk-1.2.3.jar:?]
	at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source) ~[?:?]

09-07-2025 19:06:30.492 WARN [check-update-work-group-0] [] c.t.s.o.m.c.f(): Failed to getBatchGetAvailableFwChannels, req:[OmadacModelFwInfo(oemId=v2#MGYQaaOB6vaQz5TQNtOM6Kx8P+FJkmMf0FbioZtfGdY9yj1Owady7sKIDsH5gP9S, hwId=v2#vMPJmAqK/1wRt4l9MMCbU2Nsw5SYT7WLNPkSnhgtp7XszsoR+gPouzZ92iHma/cI, compoundModel=SG3428 v2.30, showModel=SG3428 v2.30, version=2.30.9, firmwareVersion=2.30.9 Build 20250628 Rel.73019, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#hzexF52bBKnww2A6iLMxsa8AJ2BqFejABBTmT2ShtBjV76t9UA+pB460JCDAOG7Q, hwId=v2#NdWarovCsHQ6GTHanawHGUY9RYkBpwe09Yutuvw2PZ+dlmmk8lg7/eZjwV28QM3x, compoundModel=EAP245(US) v3.0, showModel=EAP245(US) v3.0, version=5.2.0, firmwareVersion=5.2.0 Build 20240914 Rel. 59923, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#AM27zUYtz0vf5hl2om68AlxvKpxR9D5HxV6W39zljnAutpIp9j7TroJ/oYf2GnWO, hwId=v2#8/LbHdxeBY1cVIUnzgWoDCfnlHaQt4MQB5qsIjqntxaMW1XM7aqYJVbbwl2qtd31, compoundModel=EAP670(US) v1.0, showModel=EAP670(US) v1.0, version=1.1.1, firmwareVersion=1.1.1 Build 20250326 Rel. 61737, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#Vm+89wE4MIykitBdNsWot+7w2oPmhvswGpzIKOY3h0JwUmR9rfaB9SP7hhS3PblR, hwId=v2#LI0TvQ4OxQyeOHYA4Ct2EC/Z8iiDNCrPlf46yNiaU34nih6hDj1ebKNd5/YWkzIp, compoundModel=T1500G-8T v2.0, showModel=T1500G-8T v2.0, version=2.0.6, firmwareVersion=2.0.6 Build 20200805 Rel.56922, pro=false, siteIds=null)]

09-07-2025 19:06:30.494 WARN [check-update-work-group-0] [] c.t.s.o.m.d.a.u.m.a(): AutoCheck upgrade handler, failed get upgrade info from cloud, omadacId:OmadacId(b7a5f8b78a44a52ee1c24e3a228eb8ea), req:[OmadacModelFwInfo(oemId=v2#MGYQaaOB6vaQz5TQNtOM6Kx8P+FJkmMf0FbioZtfGdY9yj1Owady7sKIDsH5gP9S, hwId=v2#vMPJmAqK/1wRt4l9MMCbU2Nsw5SYT7WLNPkSnhgtp7XszsoR+gPouzZ92iHma/cI, compoundModel=SG3428 v2.30, showModel=SG3428 v2.30, version=2.30.9, firmwareVersion=2.30.9 Build 20250628 Rel.73019, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#hzexF52bBKnww2A6iLMxsa8AJ2BqFejABBTmT2ShtBjV76t9UA+pB460JCDAOG7Q, hwId=v2#NdWarovCsHQ6GTHanawHGUY9RYkBpwe09Yutuvw2PZ+dlmmk8lg7/eZjwV28QM3x, compoundModel=EAP245(US) v3.0, showModel=EAP245(US) v3.0, version=5.2.0, firmwareVersion=5.2.0 Build 20240914 Rel. 59923, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#AM27zUYtz0vf5hl2om68AlxvKpxR9D5HxV6W39zljnAutpIp9j7TroJ/oYf2GnWO, hwId=v2#8/LbHdxeBY1cVIUnzgWoDCfnlHaQt4MQB5qsIjqntxaMW1XM7aqYJVbbwl2qtd31, compoundModel=EAP670(US) v1.0, showModel=EAP670(US) v1.0, version=1.1.1, firmwareVersion=1.1.1 Build 20250326 Rel. 61737, pro=false, siteIds=null), OmadacModelFwInfo(oemId=v2#Vm+89wE4MIykitBdNsWot+7w2oPmhvswGpzIKOY3h0JwUmR9rfaB9SP7hhS3PblR, hwId=v2#LI0TvQ4OxQyeOHYA4Ct2EC/Z8iiDNCrPlf46yNiaU34nih6hDj1ebKNd5/YWkzIp, compoundModel=T1500G-8T v2.0, showModel=T1500G-8T v2.0, version=2.0.6, firmwareVersion=2.0.6 Build 20200805 Rel.56922, pro=false, siteIds=null)], resp:OperationResponse(errorCode=-7119, msg=Operation failed. Please check your network connection., result=null, auditLogReturn=null, auditLogReturnList=null)

0 replies

mbentley · 2025-09-08T11:53:57Z

mbentley
Sep 8, 2025
Maintainer

If you're running the OpenJ9 image, could you re-create the container and set this environment variable for debugging SSL connections and the keystore?:

JAVA_TOOL_OPTIONS="-XX:+IgnoreUnrecognizedVMOptions -XX:+PortableSharedCache -XX:+IdleTuningGcOnIdle -Xshareclasses:name=openj9_system_scc,cacheDir=/opt/java/.scc,readonly,nonFatal -Xtune:virtualized -Djavax.net.debug=ssl:handshake:verbose -Djava.security.debug=certpath"

If you're running just the normal image, set it to:

JAVA_TOOL_OPTIONS="-Djavax.net.debug=ssl:handshake:verbose -Djava.security.debug=certpath"

Then try to reproduce the problem and provide the logs. There is going to be a lot of output so this may help to capture the logs to a file so trimming the output to the last 30 seconds, assuming you can trigger it and save the logs in that time, would be very helpful:

docker logs --since 30s omada-controller > logfile.txt 2>&1

You can bump up the time a little bit but it's really verbose so it makes it harder to parse if it is longer.

0 replies

andrema2 · 2025-09-08T13:57:36Z

andrema2
Sep 8, 2025
Author

omada6.log
Here it is. Could it be that this message saying the docker doesn't have access to the internet is causing it ? It's strange since I can do an apt update and upgrade from within the docker without problems

1 reply

mbentley Sep 8, 2025
Maintainer

Thanks for that, it's super helpful. I can see that it's complaining about not having the root CA for C=US, ST=California, L=Irvine, O=TP-Link Systems Inc., CN=TP-Link Cloud Server CA which is a custom root CA that signed n-device-omada.i.tplinkcloud.com but I need to figure out why exactly it isn't there post-upgrade (or at least that is my theory that an upgraded system doesn't have the root CA).

It doesn't seem like that root CA is in the container's trust store so I'm thinking maybe it's stored in MongoDB or one of the persistent data directories but I'll dig more and let you know if I find anything out or need anything further.

# keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit 2>&1 | grep "Cert Subject" | awk -F 'Cert Subject: ' '{print $2}' | grep -i TP-Link

# keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit 2>&1 | grep "Cert Subject" | awk -F 'Cert Subject: ' '{print $2}' | sort -u | wc -l
143

You can see this returns nothing related to tp-link.

I do not believe you are actually seeing a network connectivity issue, it's just that it doesn't trust their self-signed root CA so the connection fails to validate.

andrema2 · 2025-09-08T16:35:35Z

andrema2
Sep 8, 2025
Author

I tried to import all cert from tp-link. It didn't help. I tried a clean installation, but then I could log in. In this case I think my problem is not knowing the user and password for the first time. If the wizard should kick in in the first time, it didn't

3 replies

mbentley Sep 8, 2025
Maintainer

If there is no persistent data, it will start the wizard so it must have still had persistent data of some sort.

andrema2 Sep 8, 2025
Author

Really strange I deleted the 3 local folders. Logs, Data and Work. Is there anything else ?

mbentley Sep 8, 2025
Maintainer

Just make sure when you open the login page that you do a hard refresh in your browser because it might be caching data such as the previous cert and it looks like the page loads but it's just an old cached page. It's just those persistent data locations and as a matter of fact, you do not need the work directory >= 5.0.x, that's a leftover from the 4.x and earlier days.

mbentley · 2025-09-08T19:51:31Z

mbentley
Sep 8, 2025
Maintainer

I've reached out via the TP-Link forums beta thread: https://community.tp-link.com/en/business/forum/topic/840402?replyId=1607092

I did observe in my logs that it has this message:

09-08-2025 19:02:11.207 INFO [check-ca-certificate-update-work-group-0] [] c.t.s.o.m.c.f(): Checking Last Ca Certification...

So I am wondering if it pulls down the CA cert from somewhere and injects it at runtime. I re-created my test environment from the latest 5.15 version and then upgraded to beta-6.0 and the firmware check worked fine, unfortunately so I still can't reproduce it on my end.

0 replies

mbentley · 2025-09-08T20:58:05Z

mbentley
Sep 8, 2025
Maintainer

For the both of you - do either of you have your own certs installed or are you just using the self-signed certs?

1 reply

andrema2 Sep 8, 2025
Author

I'm using the self-signed

andrema2 · 2025-09-08T22:09:32Z

andrema2
Sep 8, 2025
Author

So, I deleted everything. The wizard showed up. I used my user and password and it failed while trying to connect to TP-Link
Here the log
omada6.log

1 reply

mbentley Sep 9, 2025
Maintainer

One thing I would suggest doing is to also file a support case with TP-Link: https://www.tp-link.com/en/support/ After having mentioned something in the v6 upgrade thread, I am not seeing anyone taking a look at it at all. I would file a support case on your behalf but I can't reproduce it and they're likely to ask you to do specific things that I would have to relay to you.

mbentley · 2025-09-12T09:55:13Z

mbentley
Sep 12, 2025
Maintainer

I did have Vincent from TP-Link reply: https://community.tp-link.com/en/business/forum/topic/840402?replyId=1608746

This feedback was forwarded to support team, please kindly check your email inbox for further follow up. Thank you for the feedback.

So I'll just wait and see if they follow up. Did either of you submit a support ticket, by chance?

0 replies

[Help]: V6 - Unable to verify firmware and certificate issue #621

Uh oh!

andrema2 Sep 7, 2025

Controller Version

Describe Your Issue or Question

Expected Behavior

Steps to Reproduce

How You're Launching the Container

Container Logs

MongoDB Logs

Additional Context

Replies: 9 comments · 11 replies

Uh oh!

mbentley Sep 7, 2025 Maintainer

Uh oh!

mbentley Sep 7, 2025 Maintainer

Uh oh!

mbentley Sep 7, 2025 Maintainer

Uh oh!

Uh oh!

mbentley Sep 7, 2025 Maintainer

Uh oh!

andrema2 Sep 7, 2025 Author

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

Uh oh!

andrema2 Sep 7, 2025 Author

Uh oh!

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

andrema2 Sep 8, 2025 Author

Uh oh!

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

andrema2 Sep 8, 2025 Author

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

andrema2 Sep 8, 2025 Author

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

mbentley Sep 8, 2025 Maintainer

Uh oh!

andrema2 Sep 8, 2025 Author

Uh oh!

andrema2 Sep 8, 2025 Author

Uh oh!

mbentley Sep 9, 2025 Maintainer

Uh oh!

mbentley Sep 12, 2025 Maintainer

andrema2
Sep 7, 2025

Replies: 9 comments 11 replies

mbentley
Sep 7, 2025
Maintainer

mbentley Sep 7, 2025
Maintainer

mbentley Sep 7, 2025
Maintainer

mbentley Sep 7, 2025
Maintainer

andrema2 Sep 7, 2025
Author

mbentley Sep 8, 2025
Maintainer

andrema2
Sep 7, 2025
Author

mbentley
Sep 8, 2025
Maintainer

andrema2
Sep 8, 2025
Author

mbentley Sep 8, 2025
Maintainer

andrema2
Sep 8, 2025
Author

mbentley Sep 8, 2025
Maintainer

andrema2 Sep 8, 2025
Author

mbentley Sep 8, 2025
Maintainer

mbentley
Sep 8, 2025
Maintainer

mbentley
Sep 8, 2025
Maintainer

andrema2 Sep 8, 2025
Author

andrema2
Sep 8, 2025
Author

mbentley Sep 9, 2025
Maintainer

mbentley
Sep 12, 2025
Maintainer