topic Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems in Wireless

How to Proactively Prevent SSC/MIC Certificate Expiration Problems

JustTakeTheFirstStep — Mon, 05 Jul 2021 19:55:45 GMT

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
https://community.cisco.com/t5/wireless-mobility-documents/lightweight-ap-fail-to-create-capwap-lwapp-connection-due-to/tac-p/4261080#M3213

I know the problem arises when the certificate of WLC/AP expires.

So, we want to prevent certificate problems in advance.

We using 5520 and 5508 WLC.

AP is using 1100 series and 2700,2800 series.

5520 version : 8.3.150

5508 version : 8.0.152

WLC's SHA1 device cert is valid for 22 years and 23 years.

Can certificate problems be prevented in advance by just using the "config ap cert-expiry-ignore {mic | ssc} enable" command??

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

MHM Cisco World — Sun, 20 Dec 2020 00:13:36 GMT

I think Yes it ignore the expire check.

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

Rasika Nayanajith — Sun, 20 Dec 2020 18:58:55 GMT

Typically AP licence is valid for 10 years and expiring of that one cause this issue. Once you issue that workaround command listed in below Field Notice, then it will ignore that check.

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

HTH

Rasika

*** Pls rate all useful responses ***

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

daswann — Wed, 17 Feb 2021 21:18:22 GMT

We have hundreds of 3502i access points at one of our locations and have the same concern. I found this in the documentation-

config ap cert-expiry-ignore {mic|ssc} enable

Important note: IOS APs (i.e. 802.11n / 802.11ac Wave 1 APs), which were manufactured with SHA-2 certificates,
cannot ignore WLC certificate expiration prior to 8.5.160.0.
See CSCvs22835

We are currently at 8.5.151.0 sounds like we will need to upgrade the code as well?

Thanks

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

patoberli — Fri, 19 Feb 2021 12:44:51 GMT

Yes in this case you must upgrade. Please note, 8.5.171.0 was just released, with many important fixes. I'd upgrade to that one (which is probably the last version for 8.5).

Release notes: https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn85mr7.html

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

daswann — Wed, 10 Mar 2021 15:56:32 GMT

8.5.171.0

Thank you Patoberli

In the CSCvs22835 bug it shows 8.5(160.0) in the known fixed releases, does that include 8.5.160.6? I'm trying to understand if these are fixed in subsequent releases in the same 160 release; or are they specific meaning only fixed in 8.5.160.0 in this as an example?

Thank you in advance for you time.

Dale

Re: How to Proactively Prevent SSC/MIC Certificate Expiration Problems

patoberli — Wed, 10 Mar 2021 16:31:27 GMT

Yes, then it should also be fixed in 8.5.160.6 typically. In rare cases this isn't true, but that's only something that TAC can answer.