C9800 WLC Web Auth broken after certificate renewal

[levi-from-downtown]

Hey all — hoping someone here has dealt with this before.

This week, our wildcard certificate expired, so we renewed it and uploaded the new PKCS#12 bundle (.pfx) to all the systems that use it — including our Cisco 9800 WLC (running IOS-XE 17.x).

The cert was uploaded via CLI (crypto pki import), and this restored HTTPS access to the WLC’s web GUI, which had been unavailable due to the expired cert. The cert is showing as valid, and everything seems correct on that front.

However, our Guest Wi-Fi broke right after this.

• The captive portal still appears when clients join the Guest SSID
• The cert looks valid there too (HTTPS works)
• But once you hit “Accept” on the portal, the redirect goes hxxps://wlc.ourdomain/undefined

Which, of course, doesn’t go anywhere.

To clarify:

• No config changes were made to the global WebAuth parameter-map
• We’re still using the same virtual-host (wlc.ourdomain) and same portal HTML
• The new trustpoint is bound to WebAuth, and everything looks normal on the surface
• redirect on-success is not configured — but it wasn't before either, and things worked fine
• I do see key pairs associated with the trustpoint (private key is present)
• Chain seems complete, though I can’t confirm if the intermediate CA was properly included in the trustpoint or not

Would appreciate any advice. This is my first time dealing with certs on a WLC.

[balaji.bandi]

But once you hit “Accept” on the portal, the redirect goes hxxps://wlc.ourdomain/undefined

what kind of cert for this, just page, what does this page does? or just redirect page.

try  browsing from client device see if that works ?

[marce1000]

  - @levi-from-downtown    I would advice to use redirect-on success anyway become 'some vacuum' has occurred as in :
                                                 parameter-map type webauth <your-map-name>
                                                        redirect on-success https://wlc.ourdomain/success.html

 M.

[MHM Cisco World]

I dont get 
you use LWA ?
you renew cert of WLC to access GUI ?

MHM

[levi-from-downtown]

Yes, we are using Local Web Authentication (LWA). The WLC is hosting the captive portal directly.

We uploaded a renewed wildcard certificate to the WLC via `crypto pki import`, and it successfully restored HTTPS access to the GUI. The wildcard certificate we had expired. 

Once the cert was applied, the Guest SSID's captive portal began redirecting to `/undefined` after clicking "Accept". We have not made any changes to the WebAuth configuration or parameter-map, and the certificate is showing valid in browsers and on the portal itself.

The cert is bound to the WebAuth parameter-map as the trustpoint.

[MHM Cisco World]

show run | section parameter-map type webauth global <<- share this 

MHM

[levi-from-downtown]

parameter-map type webauth global
type webauth
virtual-ip ipv4 192.0.2.1 virtual-host wlc.ourdomain
redirect on-success home.ourdomain
custom-page login device bootflash:/login/login.html
custom-page success device bootflash:/login/login.html
custom-page failure device bootflash:/login/login.html
custom-page login expired device bootflash:/login/login.html
logout-window-disabled
success-window-disable
intercept-https-enable
trustpoint 20250716-star.ourdomain.pfx
webauth-http-enable

I redacted the domain name. I found an old email from someone who previously worked on this in 2022, and they fixed this issue with a reload of the WLC. I didn't think that will do it, but I suppose it wouldn't hurt to try. The technician responsible for uploading the bundle has repeated his steps to verify there were no mistakes in the bundling, uploaded the .pfx and rebound it to webauth. 

[wajidhassan]

Hi @levi-from-downtown ,

This issue often happens if the certificate chain is incomplete or the trustpoint isn’t properly re-bound to WebAuth after renewal.

Check the following:

1. Make sure your .pfx includes the full chain (server + intermediate + root).

2. Reapply the trustpoint under WebAuth:

parameter-map type webauth global

 trustpoint <your-trustpoint>

3. Save config and reload the WLC — some changes don’t apply until reboot.

4. Optionally, set a redirect on-success to avoid the /undefined behavior.

That should resolve the issue.

[levi-from-downtown]

We have verified the .pfx contains the full chain, and that the trustpoint is bound to the web auth. The only thing we haven't tried is rebooting the WLC, we only reset with "no ip http server-secure" and "ip http server-secure" 

We are scheduling a reboot for later today, hopefully it is that simple. Everything else matches what we are finding online / documentation. 

[Rich R]

Did a reboot help @levi-from-downtown 
Reload should not be necessary on 9800 (we've never needed it), but you should always do the "no ip http server-secure" and "ip http server-secure" which you say you have done.

> (running IOS-XE 17.x). - sorry but 17.x is meaningless - what is the actual software version?

Have you checked your WLC config using the Config Analyzer (link and instructions below)?

You should be using a TAC recommended version of software - see the link below.

Also refer to the Best Practices guide link below.