topic Re: Virtual WLC certificate problem in Wireless

Virtual WLC certificate problem

Ivans.Pavlucenko — Mon, 05 Jul 2021 16:12:14 GMT

A problem occurs when trying to install a WebAuth certificate:

TransferTask: Sep 19 10:04:47.389: Adding cert (7998 bytes) with certificate key password.

*TransferTask: Sep 19 10:04:47.389: Add WebAuth Cert: Adding certificate & private key using password

*TransferTask: Sep 19 10:04:47.389: Add ID Cert: Adding certificate & private key using password

*TransferTask: Sep 19 10:04:47.389: Add Cert to ID Table: Adding certificate (name: bsnSslWebauthCert) to ID table using password

*TransferTask: Sep 19 10:04:47.389: Add Cert to ID Table: Decoding PEM-encoded Certificate (verify: YES)

*TransferTask: Sep 19 10:04:47.389: Decode & Verify PEM Cert: Cert/Key Length was 0, so taking string length instead

*TransferTask: Sep 19 10:04:47.389: Decode & Verify PEM Cert: Cert/Key Length 7998 & VERIFY

*TransferTask: Sep 19 10:04:47.391: Decode & Verify PEM Cert: X509 Cert Verification return code: 1

*TransferTask: Sep 19 10:04:47.391: Decode & Verify PEM Cert: X509 Cert Verification result text: ok

*TransferTask: Sep 19 10:04:47.391: Add Cert to ID Table: Decoding PEM-encoded Private Key using password

*TransferTask: Sep 19 10:04:47.391: Retrieve CSR Key: can't open private key file for ssl cert.

*TransferTask: Sep 19 10:04:47.391: Add Cert to ID Table: No Private Key

*TransferTask: Sep 19 10:04:47.391: Add ID Cert: Error decoding / adding cert to ID cert table (verifyChain: TRUE)

*TransferTask: Sep 19 10:04:47.391: Add WebAuth Cert: Error adding ID cert

*TransferTask: Sep 19 10:04:47.391: RESULT_STRING: Error installing certificate.

Can someone help ?

Re: Virtual WLC certificate problem

patoberli — Wed, 19 Sep 2018 11:58:01 GMT

Is your certificate correctly formatted, or do you have correctly created the CSR on the WLC?

See those error messages:
*TransferTask: Sep 19 10:04:47.391: Add Cert to ID Table: Decoding PEM-encoded Private Key using password
*TransferTask: Sep 19 10:04:47.391: Retrieve CSR Key: can't open private key file for ssl cert.
*TransferTask: Sep 19 10:04:47.391: Add Cert to ID Table: No Private Key

See here for the manual:
https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html
Also I think there recently was a similar post with the vWLC, where it looked like there was a bug.

Re: Virtual WLC certificate problem

Ivans.Pavlucenko — Wed, 19 Sep 2018 12:07:29 GMT

I did everything through this guide:

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

After first attempt to download the certificate, install was successful but it still show as untrusted in browser.

So i issued regenerate certificate on WLC under Web Authentication. But i didn't generate new CSR!!!

CSR is the same for Certificate. Trying to upload the second time this error occurred.

Re: Virtual WLC certificate problem

patoberli — Wed, 19 Sep 2018 12:17:54 GMT

I think you will need to generate a new CSR.
Did you reboot the WLC after you installed the first certificate? This is required.
Also, what was the reason for the invalid certificate? Wrong hostname, wrong certificate, ....?

Re: Virtual WLC certificate problem

Ivans.Pavlucenko — Wed, 19 Sep 2018 12:26:23 GMT

Yes i did a reboot.

Certificate from first try did install as i mentioned, but web authentication still was unable to trusted the WLC. So i thought that there may be an issue with the certificate and swap file a few times. In the end none of the Certificate can be installed.

I think i should start over with new CSR 😞

I was trying to do this on a Virtual WLC , generating CSR from WLC (not through the OpenSSL).

Re: Virtual WLC certificate problem

patoberli — Wed, 19 Sep 2018 12:33:22 GMT

Just checked the manual. Please note the caveat that the certificate lacks a SAN if you generate it on the WLC. That means that Chrome will always mark it as not valid!
So better user Internet Explorer or maybe Edge/Firefox for testing. But if you want to have an accepted one in all browsers, you must use the OpenSSL way and make sure that the SAN is correctly filled out (the URL/Hostname must be in the SAN).

Re: Virtual WLC certificate problem

ajc — Fri, 21 Sep 2018 15:53:24 GMT

The error that you are getting is an incorrect structure in the composed file consisting of the wlc cert, intermediate, root and encryption key. I got the same error in the past when I was following the cisco procedure which is not totally accurate so I created my own.

Re: Virtual WLC certificate problem

Ivans.Pavlucenko — Wed, 03 Oct 2018 05:13:13 GMT

We have created a certificate through openssl , and install it successfully but clients on web page still get untrusted certificate.

Certificate on WLC and at the client match.

But from pictures you can see there problem.

Re: Virtual WLC certificate problem

patoberli — Mon, 08 Oct 2018 06:18:27 GMT

The certification path is missing. Make sure to correctly format the certificate before uploading it.

Pay special attention to this part in the manual: Option B: Obtain the Final.pem File from a Third-Party CA