topic Re: Certificate install issue WLC DNA in Cisco Catalyst Center

Certificate install issue WLC DNA

glsparks — Fri, 09 Feb 2024 15:05:14 GMT

For some reason one of our pair of WLC 9800 will not accept DNAC-CA certificate.

A sync or push of telemetry from DNA fails. All our other devices are fine.

If we try a CLI import of the certificate we get this:

Trustpoint 'DNAC-CA' is a subordinate CA.
Authentication failed - could not validate certificate
% Error in saving certificate: status = FAIL

Any ideas why this is happening on this one device?

Re: Certificate install issue WLC DNA

rasmus.elmholt — Mon, 12 Feb 2024 10:18:39 GMT

Do you have port http/80 open from the WLC to the DNAC?

Re: Certificate install issue WLC DNA

glsparks — Mon, 12 Feb 2024 10:48:08 GMT

Yes the port is open. A debug isn't giving anything useful either unfortunately.

Re: Certificate install issue WLC DNA

LC.IT — Tue, 13 Feb 2024 01:28:15 GMT

Did you configure default aaa methods for authentication and authorization on C9800?

aaa authentication login default local (or group)
aaa authorization exec default local (or group)

Re: Certificate install issue WLC DNA

glsparks — Tue, 13 Feb 2024 08:29:47 GMT

Finally figured this out after some extensive debugging. Basically it was two issues. The WLC was unable to do a Certificate Revocation check and the full cert chain was not in the cert being uploaded. Once they were addressed it uploaded fine.

Re: Certificate install issue WLC DNA

Captain82 — Thu, 25 Apr 2024 00:07:34 GMT

How did you address/fix those issues?

Re: Certificate install issue WLC DNA

glsparks — Thu, 25 Apr 2024 07:04:52 GMT

As I recall it i deleted the existing trustpoint DNAC-CA.

Recreated it with the line "revocation-check crl none" e.g.

crypto pki trustpoint DNAC-CA
enrollment mode ra
enrollment terminal
usage ssl-client
revocation-check crl none
source interface GigabitEthernet0

Then manually imported the full cert chain.

DNA error then cleared and telemetry came in.

Re: Certificate install issue WLC DNA

pwelmarcus — Thu, 22 Aug 2024 18:41:04 GMT

Hi There, having a similar issue trying to chain an intermediate certificate to a root ca certificate
I have a root, intermediate and device certificate signed by a CA
"

9800(config)#crypto pki trustpoint 9800-CSR <<< This is the trustpoint created with the CSR
9800(ca-trustpoint)#chain-validation continue RootCA <<< This is the trustpoint created above
9800(config)#crypto pki authenticate 9800-CSR

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
<Intermediate CA certificate> 
-----END CERTIFICATE--.

Did your fix involve adding all certificates (Eg root-ca, Intermediate and Device)

The document i'm following only mentions adding the intermediate CA certificate, The root CA cert was successfully imported and authenticated in a previous step

-----BEGIN CERTIFICATE-----
<Intermediate CA certificate> 
-----END CERTIFICATE-----

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213917-generate-csr-for-third-party-certificate.html#toc-hId--699023295

Thanks

Re: Certificate install issue WLC DNA

glsparks — Fri, 23 Aug 2024 07:14:56 GMT

As I recall it was the full chain.

Re: Certificate install issue WLC DNA

rasmus.elmholt — Wed, 04 Sep 2024 13:06:40 GMT

As of the latest versions of the Catalyst Center software the revocation check none can now be configured using the GUI:

Re: Certificate install issue WLC DNA

marinogr — Fri, 08 Aug 2025 10:47:01 GMT

It is very important the order of Chain cert (RootCA->SubCA->Cert):

crypto pki authenticate DNAC-CA
-----BEGIN CERTIFICATE-----
RootCA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
SubCA
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Cert
-----END CERTIFICATE-----
quit

Certificate has the following attributes:
Fingerprint MD5: "omitted"
Fingerprint SHA1: "omitted"

% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
% Certificate successfully imported

Re: Certificate install issue WLC DNA

bojarskic — Thu, 02 Oct 2025 16:09:04 GMT

You da man! 🙂