topic Hi Wes ... in Wireless

Updating webauth certificate within 5508 WLC HA pair

wesdouglas — Mon, 05 Jul 2021 10:32:39 GMT

I am looking for some clarification before I go ahead and install/reboot my 5508 WLC pair.

The webauth certificate is about to expire so I have chained a new cert together. I have dual 5508s in HA mode and have uploaded the cert. I am now faced with a reboot.

However, I can't find any information online about updating certs within an HA pair, all I can find mentioning certs is in the "Configuring High Availability" section of the "Cisco Wireless LAN Controller Configuration Guide" which states "Certificates should be downloaded separately on each controller before they are paired." Does this still apply when WLCs are already in HA mode?

Has anyone here updated a cert within an HA pair and if so have you simply issued a reboot command when the cert is downloaded to the controller? Surely I don't have to break the pair apart to install the new cert on both then join together again?

Thanks in advance.

Wes

Hi Wes,This is a limitation

Divya — Fri, 17 Jul 2015 07:04:43 GMT

Hi Wes,

This is a limitation in WLC HA. you have to install the certificates on both of the Controllers.

When you do the web auth certificate installation on WLC which is in HA pair, the cert will be pushed only on Primary Controller. After the fail over to secondary, the guest clients will receive the "certificate warning" until the primary takes over.

Regards,

Divya

Hi Wes ...

saror0001 — Thu, 28 Apr 2016 10:51:56 GMT

Hi Wes ...

Did you get the solution of this situation ? Now i m on the same situation .. can u please guide ,me on the same please ??

The upload of the webauth

Freerk Terpstra — Sat, 14 May 2016 14:39:17 GMT

The upload of the webauth certificate only happens on the active unit. Once the certificate has been uploaded for the first (primary) controller you need to reload only that unit so the secondary controller is going to be the active one. Wait for the HA set to be active again, upload the certificate again and reboot that unit as well. Once that reboot has been done HA is active again and you are done.

If you do it this way there should be no impact, but personally I would still arrange a service-window just to make sure.

Please rate useful posts... 🙂

Device and root certificates

mohanak — Mon, 16 May 2016 01:41:33 GMT

Device and root certificates are not automatically synced to the Standby controller. you have to manually break HA or make failover to apply on secondary.

Re: Updating webauth certificate within 5508 WLC HA pair

Beacon Bits — Thu, 30 Aug 2018 08:52:40 GMT

Hi all,

Just to update on this one, though this post is very old.

Scenario:

=======

Uploading new WebAuth cert for Cisco WLC 5520 HA pair and 5508 two standalone.

Solution

=======

1) Standalone two 5508s were straightforward

a) upload the cert and

b) reboot

2) HA pair 5580

a) upload cert on ACTIVE one first. This WLC would be one which is being accessed by default on the management interface. Cert will be pushed to the ACTIVE WLC first and ask for the reboot.

b) reboot the WLC. In doing so, HOT STANDBY will become ACTIVE. ( monitor the management interface via ping and you'll notice no ping lose)

c) Monitor two WLCs via three Pings to see what is happening

i) continuous ping to the Management interface

ii) continuous ping to the Redundancy Mgmt Interface

iii) continuous ping to the Peer Redundancy Mgmt Interface

d) When ACTIVE WLC is back through the ping let it settle down, then check the webAuth cert via CLI command 'Show certificate webauth' on both WLCs

e) now ACTIVE would be the one that was HOT STANDBY, this would still have the old cert. Upload the cert on to this one and reboot. While doing this you'll see no ping drop on 'Management Interface'

f) After this WLC comes back it becomes HOT STANDBY, exactly the role it had before starting this exercise. Smooth isn't it 🙂

g) Check cert has been upload on both by above CLI command. Happy days!

Kind regards,

Re: Updating webauth certificate within 5508 WLC HA pair

Prkalavadia — Thu, 06 Feb 2020 08:04:58 GMT

Hi Beacon,

This information is very helpful,

Many thanks,

Re: Updating webauth certificate within 5508 WLC HA pair

brianalster — Thu, 07 May 2020 18:41:47 GMT

With the HA pair running code level 8.3 (or higher) and self-generating the CSR file, can I load the same .pem file on both contollers in the pair?