Cisco WLC Commands to Resolve AP Certificate Expiry Issues

In Cisco Wireless LAN Controller (WLC) environments, Access Points (APs) use certificates for secure communication and authentication during the joining process. However, expired certificates—whether Manufacturer Installed Certificates (MICs) or Self-Signed Certificates (SSCs)—can cause APs to fail during this process. To address these scenarios, Cisco provides two powerful commands to bypass certificate expiry validation temporarily.

Fig 1:Cert Expiry Ignore

1. Command: `config ap cert-expiry-ignore mic enable`

This command is specifically designed for APs that rely on Manufacturer Installed Certificates (MICs).

What are MICs?

MICs are factory-installed certificates that authenticate the AP as a genuine Cisco device. These certificates ensure secure communication between the AP and the WLC.

Why Use This Command?

Over time, the MICs on older APs may expire, leading to issues where the APs cannot join the WLC. The config ap cert-expiry-ignore mic enable command allows the WLC to ignore these expiry dates and proceed with the AP join process.

Use Case

This command is commonly used in production environments with legacy APs that still function but have expired MICs. It provides a temporary workaround while planning for upgrades or certificate renewal.

2. Command: `config ap cert-expiry-ignore ssc enable`

This command is designed for APs that use Self-Signed Certificates (SSCs).

What are SSCs?

SSCs are certificates generated by the AP itself when MICs are unavailable. SSCs are often used in lab environments, temporary setups, or custom configurations.

Why Use This Command?

If the SSCs on APs expire, these APs will fail to join the WLC. The config ap cert-expiry-ignore ssc enable command bypasses the expiry validation, enabling APs with expired SSCs to join seamlessly.

Use Case

This command is ideal for non-production or temporary setups where SSCs are commonly used and replacing expired certificates isn't feasible.

Security Considerations

While these commands are highly effective for resolving immediate issues, they come with potential risks:

Reduced Security: Ignoring certificate expiry can expose the network to unauthorized APs.
Temporary Solution: Use these commands only as a stopgap while planning for permanent fixes.
Best Practices:
- Update or renew expired certificates as soon as possible.
- For SSCs, consider implementing a Public Key Infrastructure (PKI) or migrating to APs with MICs.

How to Verify the Configuration?

Command = show ap cert-expiry-ignore

This will display whether certificate expiry validation is being ignored for MICs and SSCs.

Conclusion

The commands config ap cert-expiry-ignore mic enable and config ap cert-expiry-ignore ssc enable are essential tools for maintaining AP connectivity when dealing with certificate expiry issues. They provide network administrators with the flexibility to ensure uninterrupted operations while working towards long-term solutions. However, always weigh the security implications and prioritize addressing the root cause of certificate expiry.

By leveraging these commands thoughtfully, you can maintain a stable and secure wireless network, even in challenging scenarios.