AP 3702 certificate expiration date

[Aleck_Sei]

Hi all,

How can I find out the certificate expiration date of an AP 3702? I have seen the 'show crypto pki certificates' command in various forums but in the case of my AP it does not recognize that command.

Thank you very much

[JPavonM]

Cisco used to provide a tool to check the certificate (https://community.cisco.com/t5/wireless-mobility-knowledge-base/access-point-certificate-check-tool-apcertcheck/ta-p/3155582) but this is now integrated on WLAN poller tool (https://developer.cisco.com/docs/wireless-troubleshooting-tools/#!wireless-troubleshooting-tools/wireless-troubleshooting-tools)

[Rich R · Accepted solution]

Why waste time faffing around trying to check certificate dates?

Just upgrade the software and use the workaround process provided in the field notice below (FN-63942) and then you don't have to worry about whether the certificates are expired or not.

"sh crypto pki certificates" works fine on my 3702:
3702#sh crypto pki certificates
CA Certificate
Status: Available
Certificate Serial Number (hex): 01
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
Subject:
cn=Cisco Root CA M2
o=Cisco
Validity Date:
start date: 13:00:18 UTC Nov 12 2012
end date: 13:00:18 UTC Nov 12 2037
Associated Trustpoints: Trustpool cisco-m2-root-cert
Storage:

[dal]

I have more and more old C3702i that stops working because of expired certifikates. 

So I installed a virtual WLC9800 where I adjusted the date to some time in the past.

In there I have contact with the AP's.

But even when I upgrade the software to the newest version, it will not update the expiry date on the certificates

The software I have tried for the AP's are Release 15.3.3-JPQ2, which is dated March 23, 2024

What can I do?

EDIT:
I don't get it. If I go to the virtual WLC, and to Edit AP -> Inventory, it says:

Certificate Expiry-time: 03/13/2024 02:59:35

But when I SSH into the AP, and writes show crypto pki certificates, it shows several certificates, whom many of them has expiry date long into the future.

This one for example:

CA Certificate
Status: Available
Certificate Serial Number (hex): 01
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
Subject:
cn=Cisco Root CA M2
o=Cisco
Validity Date:
start date: 13:00:18 UTC Nov 12 2012
end date: 13:00:18 UTC Nov 12 2037
Associated Trustpoints: Trustpool cisco-m2-root-cert
Storage:

But clearly it's the one showed under Edit AP -> Inventory that is getting used, since the AP will not associate with our production WLC

[Rich R]

The one that matters is the MIC - Manufacturing Installed Certificate.  It's installed in the AP in the factory and normally expires after 10 years.  It cannot be updated or replaced.

The only workaround is to force the WLC to ignore the expiry date of the AP MIC certificate using the config workaround provided in https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
You would need to do that on both the main 9800 and your virtual WLC so that the AP picks up and keeps the updated config on both.  Upgrading the software will not make any difference to the MIC on the AP.
Have you done that?

[dal]

Thanks, I have entered the commands:

configure terminal
crypto pki certificate map map1 1
 issuer-name co cisco manufacturing ca
crypto pki certificate map map1 2
 issuer-name co act2 sudi ca

crypto pki trustpool policy
 match certificate map1 allow expired-certificate
    
exit

Create a Certificate Map and Add the Rules

configure terminal

crypto pki certificate map map1 1
issuer-name co Cisco Manufacturing CA

Use the Certificate Map Under the Trustpool Policy

configure terminal
crypto pki trustpool policy
match certificate map1 allow expired-certificate

 Guess we will have to wait and see the outcome.

Thanks again