OPERATIONAL DEFECT DATABASE
...
...
Authenticated AP's using EAP-TLS only permit renewal after complete certificate expiry. This scenario can be problematic in NAC based networks where the EAP timer on the switch port may timeout resulting in the port state to transition to Authc failed, isolating the reachability (and means to reload) via the WLC.
EAP-TLS based certificate authentication being configured, together with closed authentication mode within a DNAC based network.
None. You have to wait for the certificate to expire in order to renew it. Then the AP will reset its config to factory defaults the next time it reboots.
The fix to this bug is the implementation of a command on the AP (in fixed version) "capwap ap erase lsc-cert". This command does not show up in the parser or with the question mark but it does exist and it deletes the 802.1X certificate of the AP and reboots it.
Click on a version to see all relevant bugs
Cisco Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
