Downloading Ca Certificates; Using The Gui To Download Ca Certificates - Cisco 2100 Series Configuration Manual

Transferring Files to and from a Controller
Enter reset system to reboot the controller.
Step 11
After the controller reboots, enter show certificates local-auth to verify that the certificate is installed.
Step 12

Downloading CA Certificates

Controllers and access points have a Certificate Authority (CA) certificate that is used to sign and
validate device certificates. The controller is shipped with a Cisco-installed CA certificate. This
certificate may be used by EAP-FAST (when not using PACs), EAP-TLS, PEAP-GTC, and
PEAP-MSCHAPv2 to authenticate wireless clients during local EAP authentication. However, if you
wish to use your own vendor-specific CA certificate, it must be downloaded to the controller.
See the
Note
Follow the instructions in this section to download CA certificates to the controller through the GUI or
CLI. However, before you begin, make sure you have a TFTP or FTP server available for the certificate
download. Keep these guidelines in mind when setting up a TFTP or FTP server:
•
•
•
All certificates downloaded to the controller must be in PEM format.
Note

Using the GUI to Download CA Certificates

Follow these steps to download a CA certificate to the controller using the controller GUI.
Step 1 Copy the CA certificate to the default directory on your TFTP or FTP server.
Step 2 Click Commands > Download File to open the Download File to Controller page (see
Cisco Wireless LAN Controller Configuration Guide
9-16
"Configuring Local EAP" section on page 5-38
If you are downloading through the service port, the TFTP or FTP server must be on the same subnet
as the service port because the service port is not routable, or you must create static routes on the
controller.
If you are downloading through the distribution system network port, the TFTP or FTP server can
be on the same or a different subnet because the distribution system port is routable.
A third-party TFTP or FTP server cannot run on the same computer as WCS because the WCS
built-in TFTP or FTP server and the third-party TFTP or FTP server require the same
communication port.
Chapter 9 Managing Controller Software and Configurations
for information on configuring local EAP.
Figure 9-3).
OL-17037-01