topic Re: Adding custom Root/Issuer PKI certificates to Access Points via WL in Wireless

Adding custom Root/Issuer PKI certificates to Access Points via WLC

Faton-Shala — Tue, 20 Jan 2026 08:56:38 GMT

Hi everyone,

I am looking for some guidance on a specific PKI requirement for our Access Points managed by a Cisco Catalyst 9800 WLC.The Goal: I need to distribute and install an additional Root and/or Issuer CA certificate onto the Access Points themselves.

Important Clarification:

I am not talking about the SCEP integration to distribute individual device certificates to the APs (that works fine).
The goal is specifically to get the Trusted Root/Chain onto the AP’s local truststore so it can validate external services (e.g., for specific authentication or secure syslog/telemetry scenarios).

My Question: Does anyone know the exact procedure or command set to push a custom CA certificate from the 9800 WLC to the joined APs? Is there a specific "AP Join Profile" setting or a TFTP/HTTP-based method that you have successfully used for this?

Any insights or documentation links would be greatly appreciated!
Best regards,

Faton Shala

Re: Adding custom Root/Issuer PKI certificates to Access Points via WL

Mark Elsen — Tue, 20 Jan 2026 10:04:01 GMT

- @Faton-Shala That cannot be done and it is unsupported

Re: Adding custom Root/Issuer PKI certificates to Access Points via WL

Faton-Shala — Tue, 20 Jan 2026 10:08:37 GMT

Thank you Mark!
Faton

Re: Adding custom Root/Issuer PKI certificates to Access Points via WL

carlbidwell — Tue, 20 Jan 2026 11:38:43 GMT

Thanks for sharing this guide; it’s really helpful to see a clear walk through for adding custom root CA certificates to access points. Steps like these make a big difference for admins trying to ensure secure connections without running into certificate trust issues, and it’s great to have practical, detailed instructions to follow.