topic AP Certificate in Wireless

AP Certificate

hs08 — Tue, 30 Jul 2024 07:47:01 GMT

Hello,

I have CAP 3702 and WLC 2504 with version 8.5.182.0, the CAP can't join to the WLC.

Reading some article on the internet and found we must disable the NTP and change the date on the WLC to some years ago. This trick is working normally.

Now i just want to know, when the CAP joined to the WLC, there are certificate expiry validation? In this case can i say the CAP certificate is expired?

Re: AP Certificate

Leo Laohoo — Tue, 30 Jul 2024 08:11:48 GMT

FN63942 - Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

Re: AP Certificate

hs08 — Tue, 30 Jul 2024 08:39:44 GMT

So this mean AP certificate or WLC certificate is expired? How we can knowing the expiry date?

Some article say we must execute 'show crypto pki certificates' on the AP, but unlucky this command is not recognized in my AP.

Re: AP Certificate

Mark Elsen — Tue, 30 Jul 2024 09:05:40 GMT

@hs08 - It might be possible to get the expiry date by examining the running configuration on the AP and look at the certificate details.

Re: AP Certificate

hs08 — Tue, 30 Jul 2024 09:12:15 GMT

Already check the running configuration but there no information about expiry date.

Re: AP Certificate

Mark Elsen — Tue, 30 Jul 2024 09:28:01 GMT

- It doesn't matter that much , simply use the workaround commands mentioned in the field notice to let the APs join a controller even if it is on current time ,

Re: AP Certificate

Leo Laohoo — Tue, 30 Jul 2024 11:05:34 GMT

I am confident the certificate in the AP has expired.

Re: AP Certificate

MHM Cisco World — Tue, 30 Jul 2024 11:27:11 GMT

Wheb you do

Show crypto?

What option you get?

MHM

Re: AP Certificate

Mark Elsen — Tue, 30 Jul 2024 12:22:38 GMT

>...I am confident the certificate in the AP has expired.
@Leo Laohoo I second this opinion , besides if the workaround from the field notice is used such as :
ap cert-expiry-ignore {mic|ssc} enable
and the AP can then join, then you know the certificate was expired

Re: AP Certificate

hs08 — Tue, 30 Jul 2024 23:56:02 GMT

Hello,

Yes i can see the certificate expiry using show crypto command. The another question is the expired date is depend of when the AP is producing or when we upgrade the ios of that AP then this will make the certificate renewed?

Re: AP Certificate

hs08 — Tue, 30 Jul 2024 23:56:16 GMT

The another question is the expired date is depend of when the AP is producing or when we upgrade the ios of that AP then this will make the certificate renewed?

Re: AP Certificate

MHM Cisco World — Wed, 31 Jul 2024 00:00:13 GMT

Cert expired when AP producing or when cert renewed
cert date dont relate to when you upgrade the AP.

MHM

Re: AP Certificate

Mark Elsen — Wed, 31 Jul 2024 06:00:52 GMT

- The certificate is build-in and will not change when the ios on the AP is upgraded ,

Re: AP Certificate

Rich R — Wed, 21 Aug 2024 06:32:16 GMT

> So this mean AP certificate or WLC certificate is expired?
Probably both. As the others have said follow the instructions in the field notice and then it won't be a problem.

Also note that your WLC should be running 8.5.182.12 (link below) with latest bug fixes.