HP Wireless Printers cannot connect to WPA2-secured WiFi networks with Cisco/Meraki WAPs

Question

In the last two months, I've had the displeasure of working with two very different HP printers and attempting to make them work on a WPA2-secured wireless network.  All attempts to authenticate fail with "invalid phassphrase". 
I'm not the first person to encounter this, it's a problem with many different HP wireless printers (I just happen to have physical access to the OfficeJet Pro 8610 & Deskjet 3511). 
My equipment is a Cisco ASA 5505 Firewall running ASA 9.1x & Cisco Aironet 1142 running IOS 15.3.x. 
What does work on the WPA2/AES SSID:  Apple MacBook Air running OSX 10.10.2, Three Windows-Based laptops running Windows 8.1 Update 1, an iPhone 5s, Three Windows Phone 8.1 devices, Roku 2, PlayStation 4, PlayStation 3, Sharp Aquos TV, Amazon Streaming Stick, and an Android Tablet (Jellybean).  Basically, everything. 
What does not work on the WPA2 network:  OfficeJet Pro 8610 & Deskjet 3511.
To test the theory there is a problem with HP's implementation of WPA2 with regard to Cisco Aironet IOS, I built out a second SSID that only works in WPA/TKIP mode.  This solution works.  Both HP printers will join the WPA/TKIP network.
So, I'm able to demonstrate there is a certain connectivity issue.  When i look at AAA Debug on the WAP's console, I can observe the HPs attempt to authenticate "Bind I/F" on the WPA2 SSID, however they do not achieve authentication and do not pass the AAA phase.  However, on the WPA SSID, they bind and authenticate successfully. 
To help illustrate this, here is my WAP running config.  It's about as simple as it can get.  There is no relevant MAC filtering or ACLs bound to any interface.  Noting that I have an ACL on remote access to the WAP (i.e. Locked down to SSH, disabling telnet).  The main point being that the ASA firewall is not a factor in this problem as the issue is at the WAP before WPA2 authentication can complete, therefore the printers never reach the network / when the printers connect to the WPA network, the operate fully & correctly. 
If anyone at HP can indicate why this particular config is somehow improper or broken, that would be fantastic.  There should be no reason why Cisco / Meraki WAP owners have to lower wireless encryption standards just for a printer, be forced into wired, create separate SSIDs with lower encryption specifically for a device. 
Building configuration...
Current configuration : 6064 bytes
! Last configuration change at 12:46:47 UTC Fri Aug 20 1993 by admin
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname 10-10-50-1
logging buffered 1024768
logging rate-limit console 9
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
no ip source-route
no ip cef
ip domain name freedom.local
dot11 syslog
dot11 vlan-name inside vlan 50
dot11 vlan-name inside-wpa-only vlan 70
dot11 ssid inside
   vlan 50
   band-select
   authentication open
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 xxxxxx
   information-element ssidl
dot11 ssid inside-wpa-only
   vlan 70
   band-select
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 xxxxxx
   information-element ssidl
dot11 band-select parameters
   cycle-count 3
   cycle-threshold 200
   expire-supression 20
   expire-dual-band 60
   client-rssi 75
dot11 wpa handshake timeout 500
dot11 network-map
username ADMIN privilege 15 secret 5 xxxxxx
ip ssh version 2
bridge irb
interface Dot11Radio0
 no ip address
 no ip route-cache
 encryption vlan 50 mode ciphers aes-ccm
 encryption vlan 70 mode ciphers aes-ccm tkip
 ssid inside
 ssid inside-wpa-only
 antenna gain 0
 mbssid
 speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.
 channel 2412
 station-role root
 l2-filter bridge-group-acl
interface Dot11Radio0.50
 encapsulation dot1Q 50 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
interface Dot11Radio0.70
 encapsulation dot1Q 70
 no ip route-cache
 bridge-group 70
 bridge-group 70 subscriber-loop-control
 bridge-group 70 input-address-list 700
 bridge-group 70 output-address-list 700
 bridge-group 70 spanning-disabled
 bridge-group 70 block-unknown-source
 no bridge-group 70 source-learning
 no bridge-group 70 unicast-flooding
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
interface GigabitEthernet0.50
 encapsulation dot1Q 50 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
interface GigabitEthernet0.70
 encapsulation dot1Q 70
 no ip route-cache
 bridge-group 70
 bridge-group 70 spanning-disabled
 no bridge-group 70 source-learning
interface BVI1
 mac-address xxxx.xxxx.xxxx
 ip address 10.10.50.1 255.255.255.0
 no ip route-cache
ip forward-protocol nd
ip http server
ip http authentication aaa
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip route 0.0.0.0 0.0.0.0 10.10.50.2
logging history size 100
access-list 111 permit tcp any any neq telnet
bridge 1 route ip
line con 0
 access-class 111 in
line vty 0 4
 access-class 111 in
 length 0
 transport input ssh
line vty 5 15
 access-class 111 in
 transport input ssh
end

Answer 1

I get the same behavior with a laserjet m451nw. I need to enable tkip to get the printer working, it doesn't support pure aes-ccm (every other device here supports pure aes-ccm, even cheap ones), although it's advertised as working.
The following snippet of config works, but I still think it should work without the tkip "hack".
dot11 ssid whatever
vlan 1
band-select
authentication open
authentication key-management wpa version 2
interface Dot11Radio0
encryption vlan 1 mode ciphers aes-ccm tkip