WLC9800 Install Certificate and it works for webauth but not webadmin

[TRNnHelp]

I have a certificate installed and working on my WLC9800 for webauth.  The same certificate does not seem to be working for Webadmin.

For Webadmin I went into administration > management > HTTP/HTTPS/Netconf/VTY and changed the trustpoint to the one I used for webauth with the working certificate.  But still get a not secure when I go into the controller.  Is there something else that needs to be done to have it work for Webadmin?

[marce1000]

 - Review this documentation : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/221047-understand-certificate-and-trustpoint-ty.html

 M.

[TRNnHelp]

I did this and it shows the correct trustpoint certificate but I still get Your connection is not private when I access the controller

9800#show ip http server status | include trustpoint
HTTP secure server trustpoint: .pfx <-- trustpoint configured for HTTP services
HTTP secure server peer validation trustpoint:

[marce1000]

              - Make sure that the certificate is from a well known provider and or contains a valid CA , 

 M.

[TRNnHelp]

The certificate is working for webauth. Its a wildcard cert from known provider. Yes i restarted.

[Rich R]

You did not answer most of my questions which @Wes Schochet also expanded on ...

[TRNnHelp]

Its working now the issue was i needed to access the gui using the fully qualified domain name for it to work.

[Rich R]

1. What is the REASON for the "not private" in the browser? (click on the warning to see more details and the actual certificate)
2. Is the browser seeing the certificate you think you enabled?
3. Did you restart the web server as per the instructions?
4. Does the certificate exactly match the DNS FQDN you are using to access the WLC? eg https://mywlc.mycompany.com

[Wes Schochet]

Rich is asking the right questions.  I have been through this quite a bit.

First, you need to make sure the entire trust chain is included in the pfx.  Then, make sure any name that you would use int the URL is either the CN of the certificate or a SAN.  I usually use the following:

1. CN = 5520-1.myco.org
2. SAN DNS1=5520-1
3. SAN IP = 10.1.1.1  (IP for GigabitEthernet1)
4. SAN IP = 10.2.1.1  (IP for SVI for Wireless Management interface)

This way, all of your bases are covered.