Cisco AP AIR-CAP1702I-D-K9 not join in WLC 2500

[kamleshkatariya1994]

*Dec 1 10:04:34.007: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed! *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 172.17.68.201:5246 *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.17.68.201:5246

[Leo Laohoo]

FN63942 - Cisco Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

[Mark Elsen]

 @kamleshkatariya1994  FY: https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

 M.

[kamleshkatariya1994]

issue has been same not resolve 

[Mark Elsen]

    - @kamleshkatariya1994             What does that mean ?
                                                       What did you try ?

 M.

[kamleshkatariya1994]

We issued a command to ignore the MIC and SSC certificates. However, the AP did not join as expected. Additionally, the WLC was completely factory reset.
below setings apply in WLC

Upgrade to a fixed software release.
Enter the config ap cert-expiry-ignore {mic|ssc} enable command.
If any of the Cisco APs that cannot join have not downloaded the fixed software, do the following:

Disable NTP.
Set the clock back to a time before the Cisco WLC certificate expired (this might keep newer Cisco APs from joining).
Have all Cisco APs join the Cisco WLC, download new software, and rejoin.
Set the clock to the correct time and re-enable NTP.

[Mark Elsen]

    - @kamleshkatariya1994                                  >...did not join 'as expected'
                                                                       - What do you mean by that ?
                                                                       - Can you post the full boot process of an impacted access point ?
                                                                       - What software version is the 2504 controller running ?

 M.

[kamleshkatariya1994]

1) Access Point error

*Dec 1 10:04:34.007: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed! *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 172.17.68.201:5246 *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.17.68.201:5246

2) WLC 2504 software version ::: 8.5.182.0

Cisco WLC 2500 was on and APs were connected but after rebooting the WLC, the APs did not connect and an error occurred.
(And the same WLC 2500 is running.)

*Dec 1 10:04:34.007: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:509 Certificate verified failed! *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 172.17.68.201:5246 *Dec 1 10:04:34.007: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.17.68.201:5246

[Leo Laohoo]

What date is the WLC rolled back to?

[kamleshkatariya1994]

Date: 01/12/2025

[Leo Laohoo]

---

@kamleshkatariya1994 wrote:

Date: 01/12/2025

---

That is not enough. 

Roll it back to 2018 or something.

[kamleshkatariya1994]

2021

[Mark Elsen]

 - @kamleshkatariya1994  FYI : https://community.cisco.com/t5/wireless/cisco-ap-air-cap1702i-d-k9-not-join-in-wlc-2500/m-p/5351939/highlight/true#M287749

M.

[Leo Laohoo]

---

@kamleshkatariya1994 wrote:

2021

---

Da fuq?

[Mark Elsen]

   - @kamleshkatariya1994    On the access point you can use the command :  show crypto ca cert
                                             to verify the certificate validity interval

                                             Issue the show time command from the controller CLI in order to verify the date and time set on your controller falls within this validity interval. If the controller time is higher or lower than this certificate validity interval, then change the controller time to fall within this interval.

  M.