AP Certificate

[hs08]

Hello,

I have CAP 3702 and WLC 2504 with version 8.5.182.0, the CAP can't join to the WLC.

Reading some article on the internet and found we must disable the NTP and change the date on the WLC to some years ago. This trick is working normally.

Now i just want to know, when the CAP joined to the WLC, there are certificate expiry validation? In this case can i say the CAP certificate is expired?

[Leo Laohoo]

FN63942 - Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

[hs08]

So this mean AP certificate or WLC certificate is expired? How we can knowing the expiry date? 

Some article say we must execute 'show crypto pki certificates' on the AP, but unlucky this command is not recognized in my AP.

[Mark Elsen]

  @hs08   - It might be possible to get the expiry date by examining the running configuration on the AP and look at the certificate details.

  M.

[hs08]

Already check the running configuration but there no information about expiry date.

[Mark Elsen]

 - It doesn't matter that much , simply use the workaround commands mentioned in the field notice to let the APs join a controller even if it is on current time , 

 M.

[Leo Laohoo]

I am confident the certificate in the AP has expired.

[Mark Elsen]

                                 >...I am confident the certificate in the AP has expired.
  @Leo Laohoo  I second this opinion , besides if the workaround from the field notice is used such as :
                         ap cert-expiry-ignore {mic|ssc} enable
        and the AP can then join, then you know the certificate was expired

 M.

[hs08]

The another question is the expired date is depend of when the AP is producing or when we upgrade the ios of that AP then this will make the certificate renewed?

[Mark Elsen]

 - The certificate is build-in and will not change when the ios on the AP is upgraded , 

 M.

[MHM Cisco World]

Wheb you do 

Show crypto?

What option you get?

MHM

[hs08]

Hello,

Yes i can see the certificate expiry using show crypto command. The another question is the expired date is depend of when the AP is producing or when we upgrade the ios of that AP then this will make the certificate renewed?

[MHM Cisco World]

Cert expired when AP producing or when cert renewed 
cert date dont relate to when you upgrade the AP.

MHM

[Rich R]

> So this mean AP certificate or WLC certificate is expired?
Probably both.  As the others have said follow the instructions in the field notice and then it won't be a problem.

Also note that your WLC should be running 8.5.182.12 (link below) with latest bug fixes.