I solved the issue with command on AP via console:
clear capwap private-config
reload
save config -> yes
After that AP can join an another vWLC.
BTW an another cosmetic issue on vWLC: the generated SSC certificate has <support@vwlc.com> as contact address (Security -> Certificate -> SSC). However, vwlc.com is owned by a domain reseller and not by cisco.
