HP Printers - Encryption Credentials Expired & Print Queue Paused

HP networkable printers ship with a built-in self-signed certificate. People encounter this problem when the self-signed certificate expires.

It seems that macOS is requiring Secure AirPrint (encrypted traffic) and in order to do that effectively, it needs to trust the printers TLS certificate which is part of the chain of trust for encryption. The cert must not be expired.

I recently encountered this problem and the root cause was an expired self-signed certificate on the HP Printer.

I cannot speak for all printers but if other brands experience this issue the specific steps may vary but the concept is the same. I wrote this tip because there are many posts about "Encryption Credentials Expired" with few answers solving the root cause and only offering a workaround.

You need to do one of three things:

1. Create a new self-signed certificate on the printer and redo it every year with a reminder on your calendar
2. Purchase a signed certificate from a Certificate Authority (CA) extending the cert several years
3. Use LetsEncrypt.org to rotate your certs via certbot and push the updated certs to the printer(s) automatically

The easy way to change a self-signed cert on an HP printer

1. Connect to the printer with a browser to it's IP address on your network
2. Go to Networking > Certificates
3. Click View and confirm that the self-signed certificate is expired
4. Go back and click Configure and choose to create a new self-signed certificate
5. On the Mac, open the print queue that is paused and resume it.
6. Printing should start working and any queued jobs should print
7. Set a reminder on the new expiration date to update it prior to expiration about a year later
8. Rinse & Repeat every year

Purchase a Signed Certificate with a longer expiration

Certificate Authorities sell certificates and you can buy one. The printer supports a real certificate but the process is to download a CSR Certificate Signing Request from the printer, upload that to the CA, they sign it and send it back. Then you can upload to the printer. Paid certs can last years. You will need a reminder to renew the certificate giving you enough time (2-weeks) to avoid the certificate expiring.

The free and automated solution that requires some skill

A free alternative requires a more skill. You setup LetsEncrypt but you'll need a certbot running on a system that is always on. It will monitor the certificate and rotate it frequently. With a little scripting you can push the cert to the printer automatically. This is an advanced topic best suited to IT support to accomplish. Here's a couple of blog posts that partially explain it.

Peter Hicks Blog articles:

Securing an HP LaserJet printer with LetsEncrypt

Installing TLS certificates on HP printers automatically

Wolfgang on YouTube - "Quick and Easy Local SSL Certificates for Your Homelab":

https://www.youtube.com/watch?v=qlcVx-k-02E

(these are not the only methods to accomplish this goal)