Finally just change the year on the controller to 5 years back and set.. now all the cert expired APs will be joining there.. after the APs are joined just put the year back to current.
=============
Conditions:This symptom will occur after 10 years of the device manufacturing date.
The oldest APs (1120, 1130, 1230, 1310 series) with MICs were manufactured in July 2005,
so those APs will be unable to join AireOS controllers starting in July 2015.
This problem also affects WLCs approximately 10 years after manufacturing date.
For APs using Self-Signed Certificates (SSCs) that were generated by the Upgrade Tool, the symptom will occur on January 1, 2020.
SN: ALP112706LC
The AP chassis SN is in the first section of the output, for example: PID: AIR-LAP1131AG-E-K9, VID: V01, SN: FCZ1128Q0PE
The serial number format is: "LLLYYWWSSSS"; where "YY" is the year of manufacture and "WW" is the week of manufacture. The date code can be found in the 4 middle digits of the serial number.
Manufacturing Year Codes:
01 = 1997 06 = 2002 11 = 2007 16 = 2012
02 = 1998 07 = 2003 12 = 2008 17 = 2013
03 = 1999 08 = 2004 13 = 2009 18 = 2014
04 = 2000 09 = 2005 14 = 2010
05 = 2001 10 = 2006 15 = 2011
Manufacturing Week Codes:
1-5 : January 15-18 : April 28-31 : July 41-44 : October
6-9 : February 19-22 : May 32-35 : August 45-48 : November
10-14 : March 23-27 : June 36-40 : September 49-52 : December
Example: SN FCZ1128Q0PE has year code 11, meaning it was manufactured in 2007. The week code is 12, meaning it was manufactured in March.
The SN can also be found using Prime Infrastructure Reporting to find SNs for all of the APs.
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuq19142
Workaround:
Code with fix is available in CCO for 7.0, 7.4, 8.x
For 7.6, you may contact TAC for escalation code, although it is recommended to move to 8.0 for future support
Recovery for APs in a failed scenario:
NOTE: this workaround should be used only in order to allow APs with expired certificates to join the WLC for long enough to upgrade the software.
If the certificates have expired, disable NTP, then change the WLC clock time to a recent earlier time when the certificates were still valid. If you set the clock back too far, newer APs may not be able to join. Once the software has been upgraded, and the affected APs have joined, the WLC clock should be reset to the valid time.
Solution:
Cisco has released AireOS 7.0.252.0, and will release rebuilds for 7.4 in April 2015 and 8.0 in June 2015.
These rebuilds will implement a new CLI command to disable on the WLC
the lifetime validity checks for MICs and SSCs. By default, the command will be disabled, i.e. APs with expired MICs and SSCs will not be able to join.
After upgrading to the new rebuild, use the new command to disable the
lifetime validity check, allowing APs with MICs or SSCs older than 10 years to
join.
For 7.0.252.0:
(WLC)>config ap lifetime-check {mic|ssc} enable
For 7.4.140.0 and later:
(WLC)>config ap cert-expiry-ignore {mic|ssc} enable
