Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

AP certificate renewal (LSC)

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains AP certificate renewal with LSC, describing benefits, prerequisites, restrictions, and procedures for configuring automatic and forced renewal through GUI and CLI, including verification steps.

AP certificate renewal (LSC)

AP certificate renewal (LSC) is a feature that

  • allows the renewal of Locally Significant Certificates (LSCs) for Access Points before their expiration

  • ensures that the APs can continue to provide seamless services by renewing their certificates in a timely manner

  • enables the controller to orchestrate this process to minimize service disruption. The process focuses on automatic renewal mechanisms that do not require manual intervention.

LSC provisioning and renewal methods

This feature supports LSC provisioning for Access Points from two sources. You can provision from the controller through proxy-enrollment or from the Cisco Catalyst Center through secure AP onboarding. These certificates are crucial for your Access Points because they authenticate network communications. This renewal process is essential. Without a valid certificate, Access Points may lose network connectivity and affect network services.

The controller uses these methods to renew certificates:

  • Gradual Succession: A method where Access Points are renewed one at a time, which is suitable when the number of Access Points that are due for renewal is under a certain threshold.

  • Staggered Rollover: Access Points are renewed in a staggered fashion, minimizing the impact on radio coverage when the number of Access Points is larger.

  • One-Shot Renewal: All affected Access Points are renewed simultaneously, which can be disruptive and should be used as a last resort.

Benefits of AP certificate renewal (LSC)

  • Automated Renewal Process: Reduces the need for manual certificate updates, ensuring continuous service.

  • Seamless Network Operations: Minimizes network downtime by renewing certificates before they expire.

  • Enhanced Security: Maintains a high level of security by ensuring that all Access Points have valid certificates.

  • Scalable Management: Supports staggered AP renewal to reduce impact on network operations.

Requirements for AP certificate renewal (LSC)

Configure the controller and access points to use locally significant certificates before you proceed with certificate renewal.

  • Provision the locally significant certificates through the controller (proxy-enrollment) or Cisco Catalyst Center-PNP workflows.

  • Define the maintenance windows if scheduling is required for renewal.

Restrictions for AP certificate renewal (LSC)

These restrictions for access point certificate renewal (Local Significant Certificate) are:

  • Only one Local Significant Certificate is supported per access point.

  • Enable either staggered or one-shot renewal, not both.

  • Local Significant Certificate renewal applies to Cisco Wave 2 access points and newer models; older access points do not support this feature.

  • The staggered algorithm does not apply to access points in bridge mode. All Local Significant Certificate renewals for bridge mode access points occur at the same time.

Configure AP certificate auto-renewal (LSC) (GUI)

Follow these steps to configure AP certificate auto-renewal (LSC):

Procedure

1.

Choose Configuration > Wireless > Access Points > LSC Provision.
2.

In the LSC Renewal section, check the LSC Auto-Renewal check box and follow these steps:

  1. Enter a value for due time. The valid range is 5 to 60.

  2. From the Renewal Schedule drop-down list, select an existing calendar profile schedule or click the icon to create a new calendar profile. For more information about creating a calendar profile, see the Configuring a Calendar Profile (GUI) and Configuring a Calendar Profile (CLI).

  3. Use the slider to enable Syslog messages for the LSC renewal updates.

  4. From the Renewal Mode drop-down list, choose either One Shot or Staggered.

    • If you choose One Shot, all impacted AP LSCs renew in a single iteration.

    • If you choose Staggered, the system staggers the LSC renewal configuration for the APs and follow these steps:

      • Enter a value for the iteration expiry to set the expiry time for each iteration.

      • From the AP LSC Renewal per Iteration drop-down list, choose one of the following options to configure the percentage of APs to be renewed per iteration: 5%, 15%, or 25%.

        You can also see 1% and serial.

      • Enable the Client Steering slider to move clients attached to APs undergoing renewal to other APs.

      • Enable the Client Deauthentication slider to deauthenticate clients associated with the AP before it starts upgrading.

      • From the Accounting Percentage drop-down list, select the percentage of APs that should join the controller after each iteration to consider the renewal successful.

      • Use the slider to configure Accounting Action. If you select Terminate, the renewal stops if the configured percentage of APs does not join the controller. If you select Ignore, the renewal continues regardless.
3.

Click Apply.

Configure AP certificate renewal (LSC) (CLI)

Follow these steps to configure AP certificate renewal (LSC) in the controller:

Procedure

1.

Enter configuration mode.

Example:

Device# configure terminal
2.

Configure LSC provisioning on an AP.

Example:

Device(config)# ap lsc-provision
3.

Configure AP certificate renewal.

Example:

Device(config)# ap lsc-provision renew
4.

Renew AP LSCs automatically within the specified number of days.

Example:

Device(config)# ap lsc-provision renew due-time number-of-days

The valid range is from 5 to 60 days, with a default value of 30 days.
5.

Renew all AP LSCs in a single iteration.

Example:

Device(config)# ap lsc-provision renew one-shot
Note

The one-shot AP LSC renewal feature is disabled by default.
6.

Renew AP LSCs automatically in a staggered manner.

Example:

Device(config)# ap lsc-provision renew staggered timeout iteration-timeout-in-mins

Staggered AP LSC renewal is enabled by default.

Note

You cannot use one-shot and staggered renewal methods at the same time.

iteration-timeout-in-mins: The valid range is from 5 to 60 minutes.
7.

Configure time schedule for auto-renewal within a maintenance window.

Example:

Device(config)# ap lsc-provision renew scheduler calendar-profile

No scheduler is enabled by default.

When no scheduler is applied, the device auto-renews AP LSCs at 24-hour intervals and is triggered daily at 12:00 AM local time.

Note

You must configure the calendar-profile definition beforehand. For more information, see Configuring a Calendar Profile (CLI).

You have successfully configured AP certificate renewal (LSC).

Configure forced renewal of AP certificate (LSC) for individual or multiple APs (GUI)

Follow these steps to configure forced renewal of AP certificate (LSC) for individual or multiple APs via GUI:

Procedure

1.

Choose Configuration > Wireless > Bulk AP Provisioning.
2.

On the Select Parameters page, check the Renew LSC check box to renew the LSC for all selected APs.
3.

Click Next.

Configure forced renewal of AP Certificate (LSC) based on site tag (GUI)

Before you begin

Follow these steps to configure force renewal of AP certificate (LSC) based on site tag:

Procedure

1.

Choose Configuration > Tags & Profiles > Tags.
2.

In the Site tab, check the check box for the required site tag.
3.

Click Renew LSC and follow these steps:

  1. Enter the due time in days. The value must be between 1 and 60.

  2. Click Apply to Device.

Configure forced renewal of AP Certificate (LSC) based on site tag (CLI)

Follow these steps to configure the forced renewal of an AP certificate (LSC) based on a site tag using the CLI:

Procedure

1.

Enable privileged EXEC mode.

Example:

Device# enable

Enter your password if prompted.
2.

Renew a specific site-tag AP that is set to expire within the specified time.

Example:

Device# ap lsc renew due-time number-of-days site-tag site-tag-name

number-of-days: The valid range is from 1 to 60 days.

The configuration of the forced renewal of an AP Certificate (LSC) based on a site tag is complete.

Configure forced renewal of all APs (GUI)

Follow these steps to configure forced renewal of all APs (GUI):

Procedure

1.

Choose Configuration > Wireless > Access Points.
2.

From the Select an Action drop-down list, choose Renew LSC.

The Renew LSC pop-up window is displayed.
3.

Enter a due time value in minutes between 5 and 60.
4.

Click Apply to Device.

Verify AP certificate renewal (LSC)

Lists the various show commands and their outputs during the verification of the AP Certificate Renewal (LSC).

Verify LSC configuration

To verify LSC provision-related configuration details for an AP, use this command:

Device# show ap lsc-provision info
AP name     Ethernet MAC     Radio MAC      LSC authentication  LSC workflow    Cert expiry   Last renew attempt  Last renew failure
=========================================================================================================================================
AP-abc      1111.2222.3333  aaaa.bbbb.ccc0  Port-802.1x         PNP Onboarding  <time-stamp>  <time-stamp>/NA     reason-code
AP-123      1234.5678.9012  dddd.eeee.fff0  DTLS                SCEP proxy      <time-stamp>  <time-stamp>/NA     reason-code
AP-xyz      1010.1010.1010  abcd.efab.cde0  DTLS, Port-802.1x   SCEP proxy      <time-stamp>  <time-stamp>/NA     reason-code                                                                                                 0.0.0.0                         372           64                AGL          Enabled

Verify staggered LSC renewal upgrade configuration

To verify progress and status of staggered LSC renewal upgrade, use this command:


Device# show ap upgrade
Status: In progress
From version: 
To version: Unknown

Started at: 10/23/2025 08:16:01 IST
Configured percentage: 15
Percentage complete: 0
Expected time of completion: 10/23/2025 08:24:01 IST

Client steering: Enabled
Client de-authentication: Enabled
Accounting percentage: 90%
Iteration expiry time: 15 minutes

Progress Report
---------------
Iterations
----------
Iteration              Start time                          End time                    AP count
------------------------------------------------------------------------------------------------
0                      10/23/2025 08:16:01 IST             10/23/2025 08:16:01 IST     0       
1                      10/23/2025 08:16:01 IST             10/23/2025 08:18:05 IST     1       
2                      10/23/2025 08:18:05 IST             ONGOING                     0       
          
Upgraded
--------
Number of APs: 0
AP Name                          Radio MAC               Iteration       Status               Site
----------------------------------------------------------------------------------------------------

In Progress
-----------
Number of APs: 1
AP Name                          Radio MAC   
-------------------------------------------------
1815W                            00be.7517.d980  

Remaining
---------
Number of APs: 6
AP Name                          Radio MAC   
-------------------------------------------------
9166-1                           10f9.20fd.5400  
non-9120-1                       488b.0a47.d8c0  
9136_1                           687d.b45f.1610  
9120-Dev                         a00f.3704.f3a0  
9162-antenna                     ecf4.0c0e.9920  
9176+alpine                      ecf4.0c92.bac0  

APs not handled by Rolling AP Upgrade
-------------------------------------
AP Name                          Radio MAC               Status          Reason for not handling by Rolling AP Upgrade
----------------------------------------------------------------------------------------------------------------------