topic Re: config ap cert-expiry-ignore {mic|ssc} enable in Wireless

config ap cert-expiry-ignore {mic|ssc} enable

daswann — Mon, 05 Jul 2021 17:26:48 GMT

We found a couple of old 1141N AP's in our network that were not associated with the controller. Upon investigation I found that the MIC had expired. We are currently running 8.3.133 on the controllers. If this command is used in the shot term, (until I can replace them with new models) it will only be relevant to AP's with an expired MIC and not affect any other AP's from what I have read correct? Also would this leave them open to man-in-the middle attacks? Thank in advance!

Re: config ap cert-expiry-ignore {mic|ssc} enable

Mark Elsen — Wed, 22 May 2019 14:28:58 GMT

- Yes, that is correct, those with valid certs (not expired) will not be prone to man-in-the-middle attacks.

Re: config ap cert-expiry-ignore {mic|ssc} enable

daswann — Wed, 22 May 2019 14:36:49 GMT

Thank you M. just wanted to make sure. I will be replacing the access points tomorrow so I won't need to use the command but wanted a second set of eyes on it.

Re: config ap cert-expiry-ignore {mic|ssc} enable

RHEA LINN — Fri, 27 Mar 2020 13:31:51 GMT

How do you determine the MIC on the expired AP?

Re: config ap cert-expiry-ignore {mic|ssc} enable

Mark Elsen — Fri, 27 Mar 2020 15:30:38 GMT

AP_CLI#sh crypto pki certificates

Look for the line containing end date

Re: config ap cert-expiry-ignore {mic|ssc} enable

steadroy_em1 — Wed, 14 Oct 2020 15:43:46 GMT

Hi Marce - Do you know if the older APs "with expired" certs will be vulnerable to MIMs?

thanks

Re: config ap cert-expiry-ignore {mic|ssc} enable

namyong1276 — Thu, 13 Jan 2022 03:02:04 GMT

AP_CLI#sh crypto pki certificates

Does the AP check?
Does WLC check?

If I use config ap cert-expiry-ignore mic enable on WLC 5520 model, is AP OK in MIC authentication?

Re: config ap cert-expiry-ignore {mic|ssc} enable

tanios191 — Thu, 14 Jul 2022 08:18:14 GMT

Hello Marce,

Hello, I have a Cisco WLC 2504 with version 7.6.130.0 but both commands below are not available:

Command for Version 7.0.252.0:

config ap lifetime-check {mic|ssc} enable

Command for Versions 7.4.140.0 and later:

config ap cert-expiry-ignore {mic|ssc} enable

Please help

Thank you,

Re: config ap cert-expiry-ignore {mic|ssc} enable

Mark Elsen — Thu, 14 Jul 2022 09:37:44 GMT

- You need at least 8.3.x for that.

M.