I found the solution for my lab deployment. As I skipped the day-0 configuration Setup wizzard, I forgot to configure a trustpoint / certificate for the APs. I had to manually create a trustpoint via CLI: WLC_Lab#wireless config vwlc-ssc key-size 204...