The old version of open ssl 0.9.8h referenced on the cert generation doc doesn't work (if you enter a password in the CSR process). http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html#anc8 Will work on updating link. Working exact steps with v1.1.0c: Confirmed working CSR with openssl, Windows 7 64 bit machine. Install: https://slproweb.com/products/Win32OpenSSL.html Win64 OpenSSL v1.1.0c Windows Dos prompt: cd C:\OpenSSL-Win64\bin openssl req -new -newkey rsa:1024 -nodes -keyout mykey.pem -out myreq.pem -config C:\OpenSSL-Win64\bin\cnf\openssl.cnf C:\>cd C:\OpenSSL-Win64\bin C:\OpenSSL-Win64\bin>openssl OpenSSL> req -new -newkey rsa:1024 -nodes -keyout mykey.pem -out myreq.pem -config C:\OpenSSL-Win64\bin\cnf\openssl.cnf Generating a 1024 bit RSA private key ........++++++ ..................++++++ writing new private key to 'mykey.pem' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:US State or Province Name (full name) [Some-State]:NC Locality Name (eg, city) []:RTP Organization Name (eg, company) [Internet Widgits Pty Ltd]:TAC Organizational Unit Name (eg, section) []:HTTS Common Name (e.g. server FQDN or YOUR name) []:WLC-1 Email Address []:test@cisco.com Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:password123 An optional company name []:cisco OpenSSL> quit C:\OpenSSL-Win64\bin>dir *.pem  Volume in drive C has no label.  Volume Serial Number is 1496-D193  Directory of C:\OpenSSL-Win64\bin 01/06/2017  10:55 AM               932 mykey.pem 01/06/2017  10:59 AM               750 myreq.pem                2 File(s)          1,682 bytes                0 Dir(s)  304,623,710,208 bytes free ... View more

CA generated SHA2 certificates have been supported since WLC code 7.0.250. http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-6/configuration-guide/b_cg76/b_cg76_chapter_010111.html The ability for a WLC to generate a SHA2 Self Signed Certificate was introduced in 8.0.140.0, 8.2.121.0 and 8.3.102 via the following enhancement bug: CSCuz47863 SHA256 self-signed cert for WLC web admin ... View more

Some 5520 and 8540 controllers shipped from the factory without manufacturing installed certificates activated. The first symptom typically observed is the inability to access the controller via https. (Temporary workaround: enable http access.  CLI: config network webmode enable) Code upgrades will also fail due to an unactivated certificate: FTP Code transfer starting. FTP receive complete... extracting components. Failure while validating the signature! This issue is documented in the following bug:  CSCuv97685    5520 or 8540 may have no Manufacturing Installed Certificates This condition can be recovered without replacing the unit. Refer to the following document for the recovery procedure, or contact the Cisco Tac for  assistance: https://supportforums.cisco.com/blog/13046816/recovery-missing-85405520-manufacturing-installed-certificates ... View more

First thing to check with all vWLC cases Connectivity problems of any sort: radius timeouts, client ip connectivity, ap's unstable check vWLC's message log.  if you see this: #LOG-3-Q_IND: dhcp_proxy.c:3754 Received a DHCP packet sent by the controller itself possible network loop![...It occurred 5 times.!] With a very high degree of certainty, the issue documented in this bug is the cause:  CSCuj14843     vWLC: prevent service/data port confusion To fix: via the vWLC's vm, create a new vswitch that is not mapped to a physical nic. map the service port to it save the vWLC's config and power cycle the vm     ... View more