topic Re: error installing certificate - help in Wireless

error installing certificate - help

Thomas Obbekaer Thomsen — Sun, 04 Jul 2021 01:49:45 GMT

I am trying to install a webauth certificate on a WLC (5508 6.0.188).

I followed the "Generate CSR for Third-Party Certificates and Download Unchained Certificates to the WLC" document.

But when I try to upload the .pem file i get "the" "error installing certificate" promt.

I did not have any errors using OpenSSL.

Is there any debug commands that can help clearify the issue.

The Solution provided in this discussion has been added in the following Blog:-

https://supportforums.cisco.com/community/netpro/wireless-mobility/security-network-management/blog/2011/11/26/generate-csr-for-third-party-cert-and-download-unchained-cert-on-wireless-lan-controller-wlc

Re: error installing certificate - help

WaynePlotkin — Wed, 09 Jun 2010 15:40:38 GMT

I was having the same problem and worked on it for probably 8 hours trying numerous different solutions and this is what fixed it for me.

The OpenSSL versions available from www.openssl.org do not create a final.pem that work with the WLC.
I downloaded OpenSSL using this link http://www.ingate.com/files/Win32OpenSSL-0.9.6-1.0.zip and installed into C:\OpenSSL (It tries to install to program files, install location doesn't matter I just like it on the root of C)
I then followed all of the steps outline on Cisco.com http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml
Uploaded the final.pem file and it install without any problems.
My Cert was purchased from RapidSSL I don't know if that matters or not.

This was a renewal cert, so it was my second time install a cert to my WLC and I made the mistake of not keeping my original copy of OpenSSL that worked for me the first time. Don't make the mistake I made and KEEP a copy of the OpenSSL version that works for you. That will make cert renewal much easier for you.

Re: error installing certificate - help

leejohns — Tue, 15 Jun 2010 19:41:46 GMT

Open SSL v 1.x seems to cause issues. I know I have always used v0.9.8. I have also asked that the CSR doc have notes added to them mentioning issues with 1.x.

Thanks,

Lee

Re: error installing certificate - help

leejohns — Tue, 15 Jun 2010 19:52:46 GMT

FYI, I just checked the chained and unchaing CSR doc for the WLC and both do now contain a note about using v0.9.8:

Generate a CSR

Complete these steps in order to generate a CSR:

Install and open the OpenSSL application. In Windows, by default, openssl.exe is located at C:\ > openssl > bin.
Note: Cisco recommends that you use OpenSSL v0.9.8 for Windows.

Lee

Re: error installing certificate - help

ERIC BARNETT — Fri, 07 Jan 2011 20:32:14 GMT

OpenSSL 1.0 absolutely didn't work for me. My RapidSSL cert only installed under 0.98. Thanks for the help!

error installing certificate - help

rgreville666 — Thu, 14 Jul 2011 14:46:38 GMT

You legend!!! Worked a treat, the only thing I did differently was to run the OPENSSL program as an administaror (right click, run as..)

error installing certificate - help

George Stefanick — Thu, 14 Jul 2011 19:38:57 GMT

For furture searches I have included this link .. I did a complete step by step process with screen shots ...

http://www.my80211.com/home/2011/1/16/wlcgenerate-third-party-web-authentication-certificate-for-a.html

Re: error installing certificate - help

Vinay Sharma — Sun, 16 Oct 2011 17:06:28 GMT

Hello All,

Thanks for sharing this useful information. I have added all this information and created a short Blog so that all CSC customers will be able to use it.

Thanks,

Vinay Sharma

Community Manager- Wireless

Re: error installing certificate - help

Rob Simkins — Wed, 19 Oct 2011 15:55:20 GMT

One more thing....

Assuming we're using Windows version, the latest 0.9.8 binaries have a quirky difference in the way they reference the config file.

Pre 0.9.8h uses openssl.cnf

0.9.8h onwards uses openssl.cfg

However, the error msg still says its looking for "/path/openssl.cnf" for the latest versions - slightly confusing...

Add the command "-config openssl.cfg" for later versions

p.s. Hello Grev!