Skip to main content

Search

Cloudi-Fi Knowledge Base

How to add a certificate on a Cisco WLC 9800

Alexandre de THOMASSON
  • Updated

This article describes how to install a custom SSL certificate on your Cisco Wireless Controller 9800 to avoid HTTPS warning.

 

Prerequisites

Before starting, ensure that you have the following prerequisites:

TLS/SSL certificates secure internet connections by encrypting your data. They ensure that data is transmitted privately, without modifications, loss, or theft. By adding a certificate to your WLC, you will ensure a safer internet experience for your users.

Moreover, some browsers might block authentication on HTTP pages. Using a certificate will permit access to HTTPS pages, and your users will be able to authenticate.

 

1. Import the certificate

On your Cisco 9800, go to Configuration > Security > PKI Management

Cloudi-Fi_WLC_9800_certificate_PKI Management.png

In the PKI Management window, click the Add Certificate tab and expand the PKCS12 Certificate menu. Certificate Password refers to the password used when the PKCS12 certificate was generated.

Cloudi-Fi_WLC_9800_certificate_Add certificate.png

 

Then use the Desktop (HTTPS) option in the Transport Type.

Verify the certificate chain, which must contain the following 

------BEGIN CERTIFICATE------
*Device cert*
------END CERTIFICATE------
------BEGIN CERTIFICATE------
*Intermediate CA cert *
------END CERTIFICATE--------
------BEGIN CERTIFICATE------
*Root CA cert *
------END CERTIFICATE------

The certificate must be in a PKCS12 format.

You can also use the TFTP option

Cloudi-Fi_WLC_9800_certificate_Add certificate_TFTP.png

With TFTP Transport Type, you have to configure a TFTP server. (You can download a free TFTP Server). Then, add the certificate to your TFTP-Root directory. This directory has to be the storage of the TFTP server.

Add file to the TFTP server Run TFTP Server

Click on Import. After that, you should see the new certificate in the Key Pair Generation tab.

Cloudi-Fi_WLC_9800_certificate_Key Pair Certificate.png

 

2. Use the new certificate

Go to Administration > Management > HTTP/HTTPS/Netconf/VTY and choose the imported certificate from the Trust Points drop-down list and Save.

Cloudi-Fi_WLC_9800_certificate_http https netconf_trust points.png

Navigate to Configuration > Security > Web Auth, choose the global parameter map.

Cloudi-Fi_WLC_9800_certificate_security_web auth_global.png

Then choose the imported trust point from the Trustpoint drop-down list. Click Update & Apply to save the changes. Ensure that the Virtual IPv4 Hostname matches the Common Name in the certificate.

Cloudi-Fi_WLC_9800_certificate_security_web auth_global_trustpoint.png

 

3. Reboot your wireless controller

The new certificate takes effect after you reboot your controller.

 

What's next?

More details about Certificate import on WLC: Generate and Download CSR Certificates on Catalyst 9800 WLCs