WLC https GUI certificate not vaild error in Chrome

[Andrew White]

Hello,

When we browse to our 5508 WLC's web GUI it always prompts us with a warning that our certificate is not valid, but let's us proceed.  It doesn't look provisional and I want to put a valid certificate on there but have no idea on how to do this.

We have an internal certificate server on a Windows server, plus servers with IIS to create a self cert, but really that's as much as I know about certificates and wondered if anyone can help?

This is the certificate we see

Thanks

[Haydn Andrews]

Take a look at these:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configuration-guide/b_cg80/b_cg80_chapter_01001.html

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/109597-csr-chained-certificates-wlc-00.html

Its the web admin certificate you need to load

[Sathiyanarayanan Ravindran]

Generate and enroll the certificate on the WLC as per the guidelines shared by Andrews, also while generating the certificate generate it with a Subject Alternative Name. After the version 58 chrome will give certificate error, If SAN is not present.

[Andrew White]

So would I need to first generate an CSR:

Security > Certificate > CSR

Then send it to a 3rd party CA like Godaddy even though it's an internal DNS name?

Thanks

[filipe.gaspar]

You can use your own PKI with xca (or another tool) or you can request a public certificate (like verisign etc).

I'm using using xca because is very simple linux tool.

[Andrew White]

So I just need to generate the CSR as the first part to all this, then import:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configuration-guide/b_cg80/b_cg80_chapter_01001.html#generating-csr

I will use  the GUI mode.  

Just worried about after the reboot it may be inaccessible.

[filipe.gaspar]

Generating CSR is just the beginning. After that, you have to get the certificate, push it into WLC and generates an entry in your DNS server.

[patoberli]

And reboot the WLC as the last step. Don't forget the reboot.