HTTP and HTTPS not working

[Turki.A.Baqatada]

Hi 

Actually i am working on 8510 WLC and suddenly I can't access the WLC via https nor http even though are enabled

I checked the certificate validity of webadmin it shows that expired 2024 but WLC time is 2022 amd actually also new access points not joining 

[Turki.A.Baqatada]

Thank you for advice and will try with reboot WLC 

1- do you have and vedio or doucoment explain how to regenrate the local certificate i searched but not found 

2- regarding access points hard reset will resolve the issue or the only solution to install  8.0.152.0 AP code (153-3.JA12) as you mentioned ?

[Mark Elsen]

  - @Turki.A.Baqatada     1- do you have and vedio or doucoment explain how to regenrate the local certificate
                                       i searched but not found 
                                       The command was already provided to you in the thread :
                                                    config certificate generate webadmin

           For item 2 :  yes , that is the only solution

  M.

[Rich R]

If you want the documentation for that command then see the config guide:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/administration_of_cisco_wlc.html#ID523

[hellencharless54]

The expired Web Admin certificate is very likely related to both issues.

If the WLC clock is showing 2022 while the webadmin certificate expired in 2024, the controller may be using an invalid time, which can cause certificate validation problems. Modern browsers may refuse the HTTPS connection because of the certificate status, and an incorrect system time can also affect CAPWAP DTLS certificate validation, preventing new APs from joining.

A few things to check:

• Verify the WLC date, time, and NTP configuration.

• Check whether the MIC/SSC certificates used for AP authentication are still valid (show certificate all).

• Try accessing the GUI with another browser or in a private/incognito window to rule out cached certificate issues.

• Confirm whether SSH or the CLI is still accessible. If it is, you can inspect the webadmin certificate and regenerate it if necessary.

• Check the AP join failure reason with commands such as show ap join stats summary all or show ap join stats detailed <AP_Name>, and review the controller logs for certificate or DTLS errors.

Could you also share:

• The WLC software version (8.x release)?

• The output of show certificate all

• The output of show time

• Any messages from debug capwap events enable or the AP join logs?

Those details will help determine whether the issue is only the web GUI certificate or whether expired AP/DTLS certificates are also preventing new APs from joining.

[aleabrahao]

Is this generated by AI?

[Rich R]

That was my first thought too @aleabrahao 
@hellencharless54 seems oblivious to the field notices and the need to turn the clock back (with NTP off) to match old certs.
> Check whether the MIC/SSC certificates used for AP authentication are still valid (show certificate all).
Well they're almost certainly expired by now for older Aironet APs - that's the whole point of the field notices @hellencharless54  

[Turki.A.Baqatada]

How can i know mic /ssc certificates i show certificate all

For web admin it is expired since 2023 but i configured the wlc time to 2022 as i faced this issue before with only joining aps not accessing the wlc via browser  i did this and was succeeded with disabling ntp but now i can not login also found some access points or new one not joining too

Regarding join state i found error is join message decode maximum message size failed 

[Turki.A.Baqatada]

• Verify the WLC date, time, and NTP configuration. Time is 11 jul 2022

• Check whether the MIC/SSC certificates used for AP  authentication are still valid (show certificate all). How do I check I typed show certificate all is there any thing here i can focus 

• Try accessing the GUI with another browser or in a private/incognito window to rule out cached certificate issues. I tried with no luck 

• Confirm whether SSH or the CLI is still accessible. If it is, you can inspect the webadmin certificate and regenerate it if necessary. SSH WORKING AND WEB ADMIN VALID TILL 2023 IF NEEDS TO REGENERATE HOW I DO THIS AND IS THERE ANY IMPACT 

• Check the AP join failure reason with commands such as show ap join stats summary all or show ap join stats detailed <AP_Name>, and review the controller logs for certificate or DTLS errors. JOIN MESSAGE DECODE MAXIMUM MESSAGE SIZE FAILED 

Could you also share:

• The WLC software version (8.x release)?8.0.152.0

• The output of show certificate all

• The output of show time

• TIME............…............ Mon jul 11 18:19:53 2022

• Any messages from debug capwap events enable or the AP join logs

• FOR CISCO SHA1 DEVICE CERT EXPIRE ON 2023  SO BASED ON CONTROLLER TIME STILL VALID
• COULD BE CERTIFICATE OF AP IT SELF? 

[Rich R]

@Turki.A.Baqatada please read my previous reply (above) and provide the requested information?

The other reply you are reacting to (which looks to be AI generated) is of limited use - has some valid points and some not.