SCP errors are almost always firewall related. You'll want to confirm ports UPD 12222, TCP 22, HTTP 80, and TCP 443 are allowing outbound traffic. If you can't find a block on the firewall or any content filters you may have, we could run some CAPWAP debugs to get a better idea of why the updates are failing.
CAPWAP debugs*:
_debug capwap info
_debug capwap basic
_debug capwap stat
Once you've enabled these debugs, try to push an update again, wait for it to fail, then get tech data. If you can send the tech data to me at communityhelp@aerohive.com, I'll review it and let you know what we see.
*You can always disable debugs if you want by adding "no" to the front of the command. Or reboot the AP, which will disable the debugs as well.
