9800 WLC - WPA2 pre-shared key not working after uploading config file

[shadowplay101]

This how my SSID is configured: 

c9800-1(config)#key config-key password-encrypt <key>
c9800-1(config)#password encryption aes 

no broadcast-ssid
 security wpa psk set-key ascii 8 fHeEGWK[YCWF\PcLNgTidD]WQfGKVR[`aAAB
 no security wpa akm dot1x
 security wpa akm psk
 no shutdown

My problem is that if upload my config file, the pre-shared key no longer works and get the following message at book up:

 % Password encryption failed: Possible mismatch of password type & secret type!
% node-1:dbm:wireless:AKM PSK can be enabled only when PSK key is set

All I need to be able to upload a config file to my 9800 WLC and for the preshared keys to work, but also want the config file not to show the preshared key  in clear text.

What am I doing wrong?

Thanks for the help

[balaji.bandi]

May be due to garbage charcters got carry forward like any spaces in the notepad,

remove manually add directly on the device and test it,

make it simple PSK before get in to advanced make sure it working.

reference :

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/multi-preshared-key.html

[shadowplay101]

If I manually add it to the device it works, but I'm trying to have a base config file that I can upload to the WLC with the already preconfigured pre-shared keys. 

Also, if I configure it as an unencrypted key, I can upload the config file and my preshared keys work right away 

security wpa psk set-key ascii 0 test1234

 I am just trying to avoid the passphrase to be cleartext in my config file. 

Thanks for the help

[Rich R]

What version of IOS-XE are you doing this on?

[shadowplay101]

17.3.3

Your suggestion from the other thread did the trick!

-make sure AES encryption is configured with the same master key before restoring any of the backup config otherwise IOS cannot decrypt those keys.

I had to set the master key BEFORE uploading the config. Once I did this all my pre-shared keys were functional.

I guess the master key is not saved in the config?

[Rich R · Accepted solution]

Correct the master key is saved separately in a secure part of NVRAM and not backed up.

If it was then anybody could steal that config with your encrypted keys and passwords so for security reasons it has to be kept separate and the config can only be 'unlocked' by someone that knows the master key.

[shadowplay101]

Thank you makes sense now.

[Azeem Mohamad]

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/multi-preshared-key.html