topic Re: CT5760 ap cert command in Wireless

CT5760 ap cert command

AK002 — Mon, 05 Jul 2021 18:54:14 GMT

Hi Team,

What will be the equivalent command for (WLC)>config ap cert-expiry-ignore {mic|ssc} enable in Cisco CT5760 wireless controller, We suspect some certificate issue between controller and access point.

AIR-CT5760 03.06.05E

AP - 3700

Some of the AP's keep on reconnecting and joining other controllers in the setup.

Error message
PKI-3-CERTIFICATE_INVALID_EXPIRED : Certificate chain validation has failed. The certificate (SN : [chars]) has expired. Validity period ended on [chars]

Regards,

Re: CT5760 ap cert command

Mark Elsen — Wed, 01 Apr 2020 09:40:07 GMT

- Strange could you check the end date of the certificate on the AP with :

AP_CLI# show crypto pki certificates

then look for the string end date

Re: CT5760 ap cert command

AK002 — Wed, 01 Apr 2020 11:51:38 GMT

show crypto pki certificates
CA Certificate
Status: Available
Certificate Serial Number (hex): 01
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
Subject:
cn=Cisco Root CA M2
o=Cisco
Validity Date:
start date: 13:00:18 UTC Nov 12 2012
end date: 06:32:02 UTC Oct 7 1901
Associated Trustpoints: cisco-m2-root-cert
Storage:

Certificate
Status: Available
Certificate Serial Number (hex): 71B9E8530000000C2D3D
Certificate Usage: General Purpose
Issuer:
cn=Cisco Manufacturing CA SHA2
o=Cisco
--More-- Subject:
Name: AP3
e=support@cisco.com
cn=AP
o=Cisco Systems
l=San Jose
st=California
c=US
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/cmca2.crl
Validity Date:
start date: 09:49:27 UTC Jun 4 2016
end date: 09:59:27 UTC Jun 4 2026
Associated Trustpoints: Cisco_IOS_M2_MIC_cert
Storage:

CA Certificate
Status: Available
Certificate Serial Number (hex): 02
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
--More-- Subject:
cn=Cisco Manufacturing CA SHA2
o=Cisco
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/crcam2.crl
Validity Date:
start date: 13:50:58 UTC Nov 12 2012
end date: 06:32:01 UTC Oct 7 1901
Associated Trustpoints: Cisco_IOS_M2_MIC_cert
Storage:

CA Certificate
Status: Available
Certificate Serial Number (hex): 00
Certificate Usage: General Purpose
Issuer:
e=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
--More-- Subject:
e=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Validity Date:
start date: 23:38:55 UTC Feb 12 2003
end date: 23:38:55 UTC Nov 11 2012
Associated Trustpoints: airespace-old-root-cert
Storage:

CA Certificate
Status: Available
Certificate Serial Number (hex): 03
Certificate Usage: General Purpose
Issuer:
e=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
--More-- l=San Jose
st=California
c=US
Subject:
e=support@airespace.com
cn=Airespace Device CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Validity Date:
start date: 22:37:13 UTC Apr 28 2005
end date: 22:37:13 UTC Jan 26 2015
Associated Trustpoints: airespace-device-root-cert
Storage:

Certificate
Status: Available
Certificate Serial Number (hex): 5615E28A00000003E644
Certificate Usage: General Purpose
Issuer:
cn=Cisco Manufacturing CA
=Cisco Systems
Subject:
Name: AP

e=support@cisco.com
cn=AP
o=Cisco Systems
l=San Jose
st=California
c=US
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/cmca.crl
Validity Date:
start date: 09:46:55 UTC Jun 4 2016
end date: 09:56:55 UTC Jun 4 2026
Associated Trustpoints: Cisco_IOS_MIC_cert
Storage:

CA Certificate
Status: Available
Certificate Serial Number (hex): 6A6967B3000000000003
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA 2048
=Cisco Systems
Subject:
cn=Cisco Manufacturing CA
o=Cisco Systems
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/crca2048.crl
Validity Date:
start date: 22:16:01 UTC Jun 10 2005
end date: 20:25:42 UTC May 14 2029
Associated Trustpoints: Trustpool Cisco_IOS_MIC_cert
Storage:

Re: CT5760 ap cert command

patoberli — Wed, 01 Apr 2020 15:42:21 GMT

Check if the date and time is correct on the WLC (NTP enabled).
Although some CA certs have an expiration in the past 19xx, which is quite weird.
The AP certificate looks fine:
Certificate
Status: Available
Certificate Serial Number (hex): 5615E28A00000003E644
Certificate Usage: General Purpose
Issuer:
cn=Cisco Manufacturing CA
=Cisco Systems
Subject:
Name: AP

e=support@cisco.com
cn=AP
o=Cisco Systems
l=San Jose
st=California
c=US
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/cmca.crl
Validity Date:
start date: 09:46:55 UTC Jun 4 2016
end date: 09:56:55 UTC Jun 4 2026
Associated Trustpoints: Cisco_IOS_MIC_cert

Re: CT5760 ap cert command

Mark Elsen — Wed, 01 Apr 2020 16:01:29 GMT

>Some of the AP's keep on reconnecting and joining other controllers in the setup.

- What do you mean by this sentence ?

Re: CT5760 ap cert command

AK002 — Thu, 02 Apr 2020 09:51:13 GMT

Around 250 AP's are associated to WLC out of that 20 AP's are always trying to bouncing between controllers ( other Two Anchor controllers ) When they trying to connect 5760 it will download the image and trying to associate after some time it will again trying to associate other WLC and downloading the image..

Re: CT5760 ap cert command

Mark Elsen — Thu, 02 Apr 2020 10:23:07 GMT

- This is not advisable and may somehow be an underlying cause of your original issue; AP should use dedicated and known controller by for instance using DHCP option 43 to direct the AP to the intended controller.

Re: CT5760 ap cert command

AK002 — Thu, 02 Apr 2020 11:53:27 GMT

Yes from the AP end we have mentioned the primary controller, But some how the WLC is not accepting the AP join request.

Raising a case with Cisco TAC, Thanks for the help..

Re: CT5760 ap cert command

FrankCerniglia5327 — Wed, 29 Apr 2020 19:26:30 GMT

PLEASE ANSWER THIS QUESTION "What will be the equivalent command for (WLC)>config ap cert-expiry-ignore {mic|ssc} enable in Cisco CT5760 wireless controller",

I have the same issue with 1142N APs certification expiring

Re: CT5760 ap cert command

patoberli — Thu, 30 Apr 2020 06:47:48 GMT

I just had a look at the bug, field notice and community entry and I could nowhere find the 5760 mentioned.

I wonder if this controller is affected at all.

The information I've checked:

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

https://community.cisco.com/t5/wireless-mobility-documents/lightweight-ap-fail-to-create-capwap-lwapp-connection-due-to/ta-p/3155111

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuq19142

One workaround that works with all other WLC was to create your own certificate and roll it out to the APs, I wonder if that workaround would also work here.

Re: CT5760 ap cert command

FrankCerniglia5327 — Thu, 30 Apr 2020 18:00:35 GMT

I have several AP's out but when I turn back the date, the AP's comes up but can I keep the date incorrect in the 5760 Controller with out effecting the network? I just have a lot of old AP's 1140's and I am afraid they will all shut down. We are updating the WLC with 9800 but hot ready yet from the 5760 Controller. we will have to replace them but I need to make them work till that happen, I tried these command s but they do not take (bellow) is there another command that does the same for the 5760?

config ap lifetime-check {mic|ssc} enable

config ap cert-expiry-ignore {mic|ssc} enable

Re: CT5760 ap cert command

patoberli — Fri, 01 May 2020 06:41:44 GMT

I think it's not a big problem to leave the date in the past, as long as you don't use any certificate based authentication on the WLC. Of course, all logfiles have a wrong date then.

Did you look at the workaround with your own certificates for the APs?

Re: CT5760 ap cert command

pwilliams86 — Thu, 22 Oct 2020 11:13:32 GMT

Hi,

Did you ever find a command for this? We have a similar issue with anchor controllers with expired certificates not forming mobility tunnels with our 5760.

Cheers,

Re: CT5760 ap cert command

Axsuptls — Wed, 13 Oct 2021 10:31:34 GMT

Just in case anyone would still need this, since it was quite a pain on my side to find out:

9800-1#conf t
9800-1(config)#crypto pki certificate map <mapname> 1
9800-1(ca-certificate-map)#issuer-name co Cisco Manufacturing CA
9800-1(ca-certificate-map)#exit
9800-1(config)#crypto pki trustpool policy
9800-1(ca-trustpool)#match certificate <mapname> allow expired-certificate
9800-1(ca-trustpool)#end

This is mainly used for inter-controller links (anchor and such), but i believe it should be fine for AP certs too (though i did not have any problems with the APs on my 5760s so I cannot be 100% sure).

Best regards,

Re: CT5760 ap cert command

Pdub3850 — Mon, 22 Apr 2024 12:59:10 GMT

We are still using 5760 WLCs because of delays in upgrading our network and ran into this issue today and can confirm that this config fixes the issue

WLC01#show ap summary
Number of APs: 534

WLC01#conf t
WLC01(config)#crypto pki certificate map ap-cert-expired 1
WLC01(ca-certificate-map)#issuer-name co Cisco Manufacturing CA
WLC01(ca-certificate-map)#exit
WLC01(config)#crypto pki trustpool policy
WLC01(ca-trustpool)#match certificate ap-cert-expired allow expired-certificate
WLC01(ca-trustpool)#end
WLC01#
WLC01#show ap summary
Number of APs: 543

We saw an immediate jump in the number of APs joined. Many thanks Axsuptls.