WLC cert install problem: unable to get issuer certificate

[schulcz]

Hi Guys,

Our web auth cert is expired, so I would like to replace it with the new one I got.

I have a company wildcard cert chain in pem format, it contains the intermediate CA and the Root CA public cert also. I tried to upload it to the Cisco WLC (3504) but refuses it, says have some problem about the issuer. I used the same cert chain in our Aruba controllers, working great without any problems.

WLC debug says:

TFTP receive complete... Installing Certificate.

Error installing certificate.

(Cisco Controller) >*TransferTask: Mar 03 21:56:55.901: [SA] Add WebAuth Cert: Adding certificate & private key using password
*TransferTask: Mar 03 21:56:55.901: [SA] Add ID Cert: Adding certificate & private key using password
*TransferTask: Mar 03 21:56:55.901: [SA] Add Cert to ID Table: Adding certificate (name: bsnSslWebauthCert) to ID table using password
*TransferTask: Mar 03 21:56:55.901: [SA] Add Cert to ID Table: Decoding PEM-encoded Certificate (verify: YES)
*TransferTask: Mar 03 21:56:55.901: [SA] Decode & Verify PEM Cert: Cert/Key Length was 0, so taking string length instead
*TransferTask: Mar 03 21:56:55.901: [SA] Decode & Verify PEM Cert: Cert/Key Length 8965 & VERIFY
*TransferTask: Mar 03 21:56:55.905: [SA] Decode & Verify PEM Cert: X509 Cert Verification return code: 0
*TransferTask: Mar 03 21:56:55.905: [SA] Decode & Verify PEM Cert: X509 Cert Verification result text: unable to get issuer certificate
*TransferTask: Mar 03 21:56:55.905: [SA] Decode & Verify PEM Cert: Error in X509 Cert Verification at 2 depth: unable to get issuer certificate
*TransferTask: Mar 03 21:56:55.905: [SA] Add Cert to ID Table: Error decoding (verify: YES) PEM certificate
*TransferTask: Mar 03 21:56:55.905: [SA] Add ID Cert: Error decoding / adding cert to ID cert table (verifyChain: TRUE)
*TransferTask: Mar 03 21:56:55.905: [SA] Add WebAuth Cert: Error adding ID cert

I double checked the cert chain regards to this guide, the chain seems OK:
https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/215425-troubleshoot-certificate-installation-on.html

Maybe the WLC have some problems about the Root CA?
What do I need to do to successfully install the certificate?

Cert chain:

Thanks!

[Mark Elsen]

 - Review this thread : https://community.cisco.com/t5/wireless/ssl-error-opening-input-file-configure-ssl-for-a-wlc5500/td-p/3791278

  M.

[Scott Fella]

Did you combine all the certs in the proper order as a PEM?

------BEGIN CERTIFICATE------
*Device cert*
------END CERTIFICATE------
------BEGIN CERTIFICATE------
*Intermediate CA cert *
------END CERTIFICATE--------
------BEGIN CERTIFICATE------
*Root CA cert *
------END CERTIFICATE------

[Rich R]

Make sure to build the cert chain yourself following the instructions at https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html
Take note of the supported SHA versions - SHA512 is not supported.
Also take a look at https://community.cisco.com/t5/wireless-mobility-knowledge-base/certificate-signing-requests-for-wlc-via-open-ssl/ta-p/3122123