We've run across this bug recently, and spent a great deal of time figuring out what was going on.
Initially we discovered that only certain access points refused to connect to certain WLCs (3650s in our case).
Further investigation showed that this was tied to different OUI-parts of the MAC-addresses, which in turn led us to suspect that only batches of hardware were problem childs.
We successfully managed to connect problem AP's to one of our other WLCs. Since we were running the same code base (v3.6E), something else had to be the root cause.
Could be that we're not grasping the whole picture here, but the only thing we've found so far is the presence of an additional certificate issued to the WLCs not working - issued by a CA whose certificate is listed by IOS with an expiration year of 1901.
This additional certificate was not present on the working unit.
