OPERATIONAL DEFECT DATABASE
...
...
An access point is unable to join the controller. The AP console logs errors similar to the following: [*12/12/2035 12:34:50.0099] Cert Verification FAILED with error 10 (certificate has expired) at 0 depth... [*12/12/2035 12:34:50.0099] [*12/12/2035 12:34:50.0099] /C=US/ST=California/L=San Jose/O=Cisco Systems/CN=AIR-CT5508-K9-00211bfe58c0/emailAddress=support@cisco.com
The access point is running AP-COS, not IOS. The WLC's device MIC has expired. You can view the WLC's device MIC with "show certificate all". Look for the Validity period under the "Cisco SHA1 device cert": Certificate Name: Cisco SHA1 device cert Subject Name : C=US, ST=California, L=San Jose, O=Cisco Systems, CN=AIR-CT5508-K9-d0c282e0afc0, emailAddress=support@cisco.com [ ... ] Validity : Start : Jul 10 14:28:08 2009 GMT End : Jul 10 14:38:08 2019 GMT
A temporary workaround is to set the WLC's date back (you will need to disable NTP, if enabled.) If you have upgraded to software with this fix, then: * configure "config ap cert-expiry-ignore mic enable" on the WLC * set your date back, so that unfixed APs can join * wait till all AP-COS APs have downloaded the fixed code, and have rebooted and rejoined * now you can set the WLC date back to the current date
For a similar bug, that prevents newer IOS APs from joining a WLC with expired MIC, see CSCvs22835. For more information, see this Field Notice: https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
