On 14:39:18 UTC Peer certificate verification failed 001A *Aug 1 05:16:27.127: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain Jul 10 16:13:52.443 spam_lrad.c:6164 LWAPP-3-PAYLOAD_ERR: Join request does not contain valid certificate in certificate payload - AP 00:11:22:33:44:55Īn example of a WLC's MIC expiration case is shown here, as seen on a Cisco IOS ® AP: At the time of the join failure, the AireOS WLC msglog might show messages similar to this example: The wireless APs fail to connect to the AireOS WLCs. Here are some examples of the types of error message you might see when you experience this issue. Other AP and WLC models continue to be manufactured with certificates that expire in 2037. Starting in 2019, all 9800 WLCs and 9100 APs were manufactured with certificates that expire in 2099. Starting in 2017, Cisco manufactured all wireless devices with MICs that expire in 2037. Prior to July 18, 2005, Cisco APs were not manufactured with MICs.Īll Cisco wireless products that were manufactured between July 18, 2005, and mid-2017 have MICs that expire after 10 years. The MICs were incorporated into the Cisco wireless products as a way to provide this identity. Authentication of the infrastructure devices is used in order to protect the network from uncontrolled devices. In the context of this Field Notice, digitally signed X.509 certificates are used specifically for cryptographic identity validation of the device hardware. In order to help determine the potential future impact, a list of APs and WLCs and their release dates can be found in the Lightweight AP - Fail to create CAPWAP/LWAPP connection due to certificate expiration Cisco Community article. The likelihood that this issue will be encountered is 100% for wireless APs and WLCs that are more than 10 years old and were manufactured prior to 2017. When you configure mobility tunnels between controllers, they fail to establish a connection. When an AP attempts to establish a new connection, the AP fails to join. WLC-to-Mobility Services Engine (MSE) or Connected Mobile Experience (CMX) Network Mobility Services Protocol (NMSP) connections.

WLC-to-WLC encrypted mobility connections (CAPWAP).

AP-to-WLC Control and Provisioning of Wireless Access Points (CAPWAP) connections.

IOS AP with SHA2 MIC certificate fails to join WLC with config ap cert-expiry-ignore mic enableĭue to the expiration of Manufacturer Installed Certificates (MICs) in Wireless LAN Controllers (WLCs) and/or Access Points (APs), connections of these types might fail to establish:

LAP/WLC MIC lifetime expiration causes DTLS failureĬSCuq19142 workaround doesn't work on very old 4400s with Airespace MICĪP-COS: AP not joining after enabling MIC certificate expiry check

Serials 2000 8.1 update