WLC fail to connect with cisco Licensing Portal

[Rushali Sharma]

I Feel Lucky as I am writing my first conversation on cisco community; I hope the discussion will be useful.

Issue Reported: One of my Client have WLC 5520 earlier they were running the RTU license (Right to use) and they were planning to move towards Smart Licensing.

WLC: 5520 Version: 8.5.171.0 (Not the recommended code) Because they have some legacy AP in their network 

Now the Problem arises when they converted 4 WLC out of 9 with Smart licensing but 5 WLC still remain with RTU because they tried converted and they got the below error.

Registration: Status: REGISTERING - REGISTRATION IN PROGRESS

Export-Controlled Functionality: Not Allowed

Initial Registration: FAILED on Oct 31 16:49:10 2022 HKT

Failure reason: Fail to send out Call Home HTTP message.

Next Registration Attempt: Oct 31 17:53:58 2022 HKT

We followed the Step-by-Step troubleshooting we checked DNS working On ALL WLC, Traffic to tools.cisco.com is Also Allowed, but we Still wonder why we are getting the Same Error, so we did research about this, and we found One Field Notice Related to this 

Field Notice: FN - 72323 - Cisco IOS XE Software: QuoVadis Root CA 2 Decommission Might Affect Smart Licensing, Smart Call Home, and Other Functionality - Software Upgrade Recommended - Cisco

CSCvx00521: Bug Search Tool (cisco.com)

Ans as per the Field Notice and the Bug mentioned we have Install the Iden Trust Commercial Root CA 1 to the trust pool manually or import the latest ios_core.p7b from cisco trust store. Unfortunately, it didn't work for us.

After which we searched again about this topic and found the Latest field notice where its mentioned 

Workaround/Solution

Cisco has migrated from the QuoVadis Root CA 2 to the IdenTrust Commercial Root CA 1 for SSL certificates. Cisco recommends one of these two options to add the new IdenTrust Commercial Root CA 1 certificate to the AireOS.

* Solution - Software upgrade (preferred)
* Workaround - open access to tools.cisco.com<https://tools.cisco.com>.

Solution for AireOS WLCs (Preferred)

For AireOS devices, upgrade to one of the software versions shown in the table to resolve the root CA certificate issue for affected platforms.
WLC Model

Fixed Version

* Cisco 3504 Wireless Controller
* Cisco 5520 Wireless Controller
* Cisco 8540 Wireless Controller
* Cisco Virtual Wireless Controller

* 8.10.181.0 or later

Note: WLCs not listed here are not affected by this issue.

Workaround for AireOS WLCs

Configure your network to allow your WLC to access tools.cisco.com<http://tools.cisco.com>; via TCP ports 80 and 443. Enter the show network summary command to see the WLC's DNS server. Query the DNS server that is configured on your WLC to find out the IP address(es) to which tools.cisco.com<http://tools.cisco.com>, resolves.

Once the WLC has access to tools.cisco.com<http://tools.cisco.com>; it will automatically download the IdenTrust Commercial Root CA 1 certificate.

When the certificate update happens, there is no reboot required.

In order to confirm that the IdenTrust Commercial Root CA 1 certificate is installed on the WLC, enter the grep include IdenTrust "show certificate all" command.
Field Notice: FN - 72415 - QuoVadis Root CA 2 Decommission Might Affect AireOS Smart Licensing and Smart Call Home, and Mobility Express Software Downloads from Cisco.com - Software Upgrade Recommended - Cisco

Hence Issue Resolved! if anyone have any additional information kindly share:)

[Arshad Safrulla]

Hi Rushali,

Welcome to community. Glad your customer issue is resolved. Is there any specific reason customer was advised to move to smart licensing? What is the advantages customer gained from this move? 

[Rich R]

I would never recommend a customer to choose to move to Smart Licensing unless absolutely necessary (no choice on new platforms and new versions of IOS-XE which only support smart licensing).  We have numerous problems with smart licensing and these certificate issues are just some of them.  According to Cisco marketing we (customers) wanted smart licensing and it should make our lives easier but so far our experience is the exact opposite of this.  On an older platform like 5520 I'd recommend to keep using RTU licensing.