Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Provisioning locally significant certificates

Updated: April 10, 2026

Want to summarize with AI?

Details the configuration, provisioning, management, and verification of locally significant certificates (LSCs), including RSA key and PKI trustpoint setup, certificate enrollment, AP LSC provisioning, trustpool management, and secure wireless network authentication using both GUI and CLI procedures.

Configure RSA key for PKI trustpoint

Generate RSA cryptographic keys for PKI trustpoint authentication and secure communications.

RSA keys are essential components of PKI infrastructure, providing the cryptographic foundation for certificate-based authentication and encryption on wireless controllers.

Before you begin

Ensure the device is in a stable operational state and has sufficient processing resources for key generation.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Generate RSA key for PKI trustpoint. Example: `Device(config)# crypto key generate rsa exportable general-keys modulus key-size label RSA-key-label` Example: `Device(config)# crypto key generate rsa exportable general-keys modulus 2048 label lsc-tp` exportable is an optional keyword. You may or may not want to configure an exportable-key. If selected, you can export the key out of the box, if required. key-size: Size of the key modulus. The valid range is from 2048 to 4096. RSA-key-label: RSA key pair label.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end`

The RSA key is successfully generated and labeled for use with PKI trustpoint configurations.

Configure PKI trustpoint parameters

Configure a PKI trustpoint with RSA key parameters for certificate enrollment and authentication.

PKI trustpoints define the relationship between the device and a Certificate Authority (CA), enabling secure certificate-based authentication and encryption.

Before you begin

Ensure the CA server is accessible and configured to accept certificate requests.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create a new trustpoint for an external CA server. Example: `Device(config)# crypto pki trustpoint trustpoint-name` Example: `Device(config)# crypto pki trustpoint microsoft-ca` The trustpoint-name refers to the trustpoint name.
	3.	Specify the URL of the CA on which your router should send certificate requests. Example: `Device(ca-trustpoint)# enrollment url HTTP-URL` Example: `Device(ca-trustpoint)# enrollment url http://CA_server/certsrv/mscep/mscep.dll` HTTP-URL: URL of the file system where your router should send certificate requests. An IPv6 address can be added in the URL enclosed in brackets. For example: http://[2001:DB8:1:1::1]:80. For more enrollment method options, see the enrollment url (ca-trustpoint) command page.
	4.	Create subject name parameters for the trustpoint. Example: `Device(ca-trustpoint)# subject-name subject-name` Example: `Device(ca-trustpoint)# subject-name C=IN, ST=KA, L=Bengaluru, O=Cisco, CN=eagle-eye/emailAddress=support@abc.com`
	5.	Map RSA key with that of the trustpoint. Example: `Device(ca-trustpoint)# rsakeypair RSA-key key-size` Example: `Device(ca-trustpoint)# rsakeypair ewlc-tp1` RSA-key: RSA key pair label. key-size: Signature key length. Range is from 360 to 4096.
	6.	Configure revocation checking method. Example: `Device(ca-trustpoint)# revocation {crl \| none \| ocsp}` Example: `Device(ca-trustpoint)# revocation none`
	7.	Return to privileged EXEC mode. Example: `Device(ca-trustpoint)# end`

The PKI trustpoint is now configured with the specified parameters and ready for certificate enrollment operations.

Authenticate and enroll a Public Key Infrastructure (PKI) trustpoint (GUI)

Use this procedure to add and authenticate a Public Key Infrastructure (PKI) trustpoint to enable certificate-based security for your device.

Before you begin

Obtain the enrollment URL and certificate authority information from your network administrator.

Procedure

Choose Configuration > Security > Public Key Infrastructure (PKI) Management.

In the Public Key Infrastructure (PKI) Management window, click the Trustpoints tab.

In the Add Trustpoint dialog box, provide this information:

In the Label field, enter the RSA key label.
In the Enrollment URL field, enter the enrollment URL.
Check the Authenticate check box to authenticate the Public Certificate from the enrollment URL.
In the Subject Name section, enter the Country Code, State, Location, Organization, Domain Name, and Email Address.
Check the Key Generated check box to view the available RSA keypairs. Choose an option from the Available RSA Keypairs drop-down list.
Check the Enroll Trustpoint check box.
In the Password field, enter the password.
In the Re-Enter Password field, confirm the password.
Click Apply to Device.

The new trustpoint is added to the trustpoint name list.

The new trustpoint is now listed in the trustpoint name list and is ready for use.

What to do next

After enrolling the trustpoint, configure it for use with your security policies or certificate-based authentication features.

Authenticate and enroll the PKI trustpoint with CA server (CLI)

Establish secure communication between the device and Certificate Authority by authenticating and enrolling a PKI trustpoint.

PKI trustpoints enable secure certificate-based authentication. The authentication process fetches the CA certificate, while enrollment generates and submits a certificate request to obtain a client certificate.

Before you begin

Ensure the PKI trustpoint is configured and the CA server is accessible.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Fetch the CA certificate. Example: `Device(config)# crypto pki authenticate trustpoint-name` Example: `Device(config)# crypto pki authenticate microsoft-ca`
	3.	Accept the CA certificate. Example: `Device(config)# % Do you accept this certificate? [yes/no]: yes Trustpoint CA certificate accepted.`
	4.	Enroll the client certificate. Example: `Device(config)# crypto pki enroll trustpoint-name` Example: `Device(config)# crypto pki enroll microsoft-ca % % Start certificate enrollment .. % Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate. For security reasons your password will not be saved in the configuration. Please make a note of it.`
	5.	Enter a challenge password to the CA server. Example: `Device(config)# password` Example: `Device(config)# abcd123`
	6.	Re-enter the challenge password to the CA server. Example: `Device(config)# password` Example: `Device(config)# abcd123`
	7.	Include the router serial number in the subject name. Example: `Device(config)# % Include the router serial number in the subject name? [yes/no]: yes`
	8.	Exclude IP address from the subject name. Example: `Device(config)# % Include an IP address in the subject name? [no]: no`
	9.	Request certificate from CA. Example: `Device(config)# Request certificate from CA? [yes/no]: yes % Certificate request sent to Certificate Authority % The 'show crypto pki certificate verbose client' command will show the fingerprint.`
	10.	Return to privileged EXEC mode. Example: `Device(config)# end`

The PKI trustpoint is authenticated and enrolled with the CA server, enabling secure certificate-based communication.

Configure AP join attempts with LSC certificate

Procedure

	1.	Choose Configuration > Wireless > Access Points.
	2.	In the All Access Points window, click the LSC Provision name.
	3.	From the Status drop-down list, choose a status to enable LSC.
	4.	From the Trustpoint Name drop-down list, choose the trustpoint.
	5.	In the Number of Join Attempts field, enter the number of retry attempts that will be permitted.
	6.	Click Apply.

Configure AP join attempts with LSC certificate (CLI)

Configure the maximum number of AP join failure attempts with a newly provisioned LSC certificate to ensure proper fallback to MIC when needed.

When APs attempt to join with LSC certificates and exceed the configured failure limit, they automatically fall back to using their Manufacturer Installed Certificate (MIC) for authentication.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Specify the maximum number of AP join failure attempts with the newly provisioned LSC certificate. Example: `Device(config)# ap lsc-provision join-attempt number-of-attempts` Example: `Device(config)# ap lsc-provision join-attempt 10` When the number of AP joins exceed the specified limit, AP joins back with the Manufacturer Installed Certificate (MIC).
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The AP join attempt limit with LSC certificate is now configured. APs will fall back to MIC authentication after exceeding the specified number of failed join attempts.

Configure subject-name parameters in LSC certificate

Configure the subject-name parameters that will be included in LSC certificates generated by access points.

Subject-name parameters define the identity information included in Local Significant Certificate (LSC) requests generated by access points. These parameters include geographical and organizational details that identify the certificate holder.

Procedure

Enter global configuration mode.

Example:

Device# configure terminal

Specify the attributes to be included in the subject-name parameter of the certificate request generated by an AP.

Example:

Device(config)# ap lsc-provision subject-name-parameter 
country country-str state state-str city city-str domain domain-str org 
org-str email-address email-addr-str

Example:

Device(config)# ap lsc-provision subject-name-parameter 
country India state Karnataka city Bangalore domain domain1 org 
Right email-address adc@gfe.com

Return to privileged EXEC mode.

Example:

Device(config)# end

The subject-name parameters are now configured for LSC certificate generation on access points.

Configure key size for LSC certificate

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Specify the size of keys to be generated for the LSC on AP. Example: `Device(config)# ap lsc-provision key-size key-size` Example: `Device(config)# ap lsc-provision key-size 2048` Valid key size options are 2048, 3072, or 4096 bits.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configure trustpoint for LSC provisioning on an AP

Establish a trustpoint for Local Significant Certificate (LSC) provisioning to enable secure communication between access points and the controller.

LSC provisioning allows access points to obtain certificates from a designated trustpoint, enhancing network security through certificate-based authentication.

Before you begin

Ensure the trustpoint is properly configured and accessible on the network.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Specify the trustpoint with which the LSC is provisioned to an AP. Example: `Device(config)# ap lsc-provision trustpoint tp-name` Example: `Device(config)# ap lsc-provision trustpoint microsoft-ca` The tp-name is the trustpoint name.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end`

The trustpoint for LSC provisioning is now configured and ready to provision certificates to access points.

Configure an AP LSC provision list (GUI)

Procedure

	1.	Choose Configuration > Wireless > Access Points.
	2.	In the All Access Points window, click the corresponding LSC Provision name.
	3.	From the Status drop-down list, choose a status to enable LSC.
	4.	From the Trustpoint Name drop-down list, choose a trustpoint.
	5.	In the Number of Join Attempts field, enter the number of retry attempts that are allowed.
	6.	From the Key Size drop-down list, choose a key.
	7.	In the Edit AP Join Profile window, click the CAPWAP tab.
	8.	In the Add APs to LSC Provision List section, click Select File to upload the CSV file that contains AP details.
	9.	Click Upload File.
	10.	In the AP MAC Address field, enter the AP MAC address. and add them. (The APs added to the provision list are displayed in the APs in provision List .)
	11.	In the Subject Name Parameters section, enter the following details: Country State City Organization Department Email Address
	12.	Click Apply.

Configure an AP LSC provision list (CLI)

Add access points to the LSC provision list for certificate-based authentication.

The LSC provision list allows you to specify which access points can use locally significant certificates for authentication with the wireless controller.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Add the AP to the LSC provision list. Example: `Device(config)# ap lsc-provision mac-address mac-address` Example: `Device(config)# ap lsc-provision mac-address 001b.3400.02f0` Note You can provision a list of APs using the ap lsc-provision provision-list command. (Or) You can provision all the APs using the ap lsc-provision command.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end`

The AP is now added to the LSC provision list and can use locally significant certificates for authentication.

Configure LSC provisioning for all the APs (GUI)

Procedure

	1.	Choose Configuration > Wireless > Access Points.
	2.	In the Access Points window, expand the LSC Provision section.
	3.	Set Status to Enabled state. Note If you set Status to Provision List, LSC provisioning will be configured only for APs that are a part of the provision list.
	4.	From the Trustpoint Name drop-down list, choose the appropriate trustpoint for all APs.
	5.	In the Number of Join Attempts field, enter the number of retry attempts that the APs can make to join the controller.
	6.	From the Key Size drop-down list, choose the appropriate key size of the certificate: 2048 3072 4096
	7.	In the Add APs to LSC Provision List section, click Select File to upload the CSV file that contains the AP details.
	8.	Click Upload File.
	9.	In the AP MAC Address field, enter the AP MAC address. (The APs that are added to the provision list are displayed in the APs in Provision List section.)
	10.	In the Subject Name Parameters section, enter the following details: Country State City Organization Department Email Address
	11.	Click Apply.

Configure LSC provisioning for all APs (CLI)

Enable LSC (Local Significant Certificate) provisioning across all access points to enhance security through automatic certificate management.

LSC provisioning allows access points to automatically obtain and manage security certificates, reducing manual certificate deployment overhead while maintaining secure wireless communications.

Before you begin

Ensure you have administrative access to the wireless controller and that all APs are properly registered with the controller.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Enable LSC provisioning for all APs. Example: `Device(config)# ap lsc-provision` By default, LSC provisioning is disabled for all APs.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end`

LSC provisioning is now enabled for all access points, allowing them to automatically obtain and manage security certificates.

Configure LSC provisioning for the APs in the provision list

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Enable LSC provisioning for a set of APs configured in the provision list. Example: `Device(config)# ap lsc-provision provision-list`
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Import a CA certificate to the trustpool (GUI)

PKI Trustpool Management is used to store a list of trusted certificates (either downloaded or built in) used by the different services on the controller. This is also used to authenticate a multilevel CA certificate. The built in CA certificate bundle in the PKI trustpool receives automatic updates from Cisco if they are not current, are corrupt, or if certain certificates need to be updated.

Perform this task to manually update the CA certificates in the PKI trustpool.

Note

If your LSC has been issued by an intermediate CA, you must import the complete chain of CA certificates into the trustpool. Otherwise, you will not be able to provision the APs without the complete chain being present on the controller. The import step is not required if the certificate has been issued by a root CA.

Follow these steps to import a CA certificate to the trustpool using GUI:

Procedure

	1.	Choose Configuration > Security > PKI Management.
	2.	In the PKI Management window, click the Trustpool tab.
	3.	Click Import.
	4.	In the CA Certificate field, copy and paste the CA certificate. Link together the multiple CA certificates in .pem format.
	5.	Click Apply to Device.

Import a CA certificate to the trustpool

Import a CA certificate to establish trust relationships for secure communications.

The trustpool stores CA certificates that the device uses to validate certificates presented by other entities during secure communications.

Procedure

Enter global configuration mode.

Example:

Device# configure terminal

Import the root certificate to the trustpool.

Example:

Device(config)# crypto pki trust pool import terminal
% Enter PEM-formatted CA certificate.
% End with a blank line or "quit" on a line by itself.
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
Aug 23 02:47:33.450: %PKI-6-TRUSTPOOL_DOWNLOAD_SUCCESS: 
Trustpool Download is successful

You need to paste the CA certificate from the digicert.com.

Return to privileged EXEC mode.

Example:

Device(config)# end

The CA certificate is successfully imported to the trustpool and can be used for certificate validation.

Clean the CA certificates imported in trustpool (GUI)

Procedure

	1.	Choose Configuration > Security > PKI Management.
	2.	In the PKI Management window, click the Trustpool tab.
	3.	Click Clean. Note This erases the downloaded CA certificate bundles. However, it does not erase the built-in CA certificate bundles.
	4.	Click Yes.

Clean CA certificates imported in trustpool (CLI)

You cannot delete a specific CA certificate from the trustpool. However, you can clear all the CA certificates that are imported to the Trustpool.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Erase the downloaded CA certificate bundles. Example: `Device(config)# crypto pki trustpool clean` This command does not erase the built-in CA certificate bundles.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Create a new trustpoint dedicated to a single CA certificate

Establish a trustpoint that is specifically configured for a single Certificate Authority (CA) certificate to enable secure PKI operations.

A trustpoint represents a Certificate Authority (CA) or identity certificate that is used for PKI operations. Creating a dedicated trustpoint for a single CA certificate helps organize and manage different certificate authorities in the network.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create a trustpoint. Example: `Device(config)# crypto pki trustpoint tp-name` Example: `Device(config)# crypto pki trustpoint tp_name`
	3.	Create an enrollment terminal for the trustpoint. Example: `Device(ca-trustpoint)# enrollment terminal`
	4.	Exit from the trustpoint configuration. Example: `Device(ca-trustpoint)# exit`
	5.	Authenticate the trustpoint. Example: `Device(config)# crypto pki authenticate tp-name` Example: `Device(config)# crypto pki authenticate tp_name <<< PASTE CA-CERT in PEM format followed by quit >>>`

The trustpoint is now created and authenticated with the CA certificate, ready for PKI operations.

Verify LSC configuration

Use show commands to verify Local Security Certificate (LSC) configuration. View wireless management trustpoint details and Local Security Certificate (LSC) provision-related configuration for your access points.

To view the wireless management trustpoint details, use this command:

Device# show wireless management trustpoint

Trustpoint  Name : microsoft-ca
Certificate Info : Available
Certificate Type : LSC
Certificate Hash : 9e5623adba5307facf778e6ea2f5082877ea4beb
 Private key Info : Available

To view the Local Security Certificate (LSC) provision-related configuration details for an AP, use this command:

Device# show ap lsc-provision summary

AP LSC-provisioning : Disabled
Trustpoint used for LSC-provisioning : lsc-root-tp
Certificate chain status : Available
Number of certs on chain : 2
Certificate hash : 7f9d05183deecac4e5a79db65d538245685e8e30
LSC Revert Count in AP reboots : 1

AP LSC Parameters :
Country : IN
State : KA
City : BLR
Orgn : ABC
Dept : ABC
Email : support@abc.com
Key Size : 2048
EC Key Size : 384 bit

AP LSC-provision List :

Total number of APs in provision list: 2

Mac Addresses :
--------------
1880.90f5.1540
2c5a.0f70.84dc

Configure management trustpoint to LSC

Procedure

	1.	Choose Administration > Management > HTTP/HTTPS.
	2.	In the HTTP Trust Point Configuration section, set Enable Trust Point to the Enabled state.
	3.	From the Trust Points drop-down list, choose the appropriate trustpoint.
	4.	Save the configuration.

Configure management trustpoint to LSC (CLI)

Configure management trustpoint to enable Local Significant Certificate (LSC) authentication for access points.

After LSC provisioning, the APs will automatically reboot and join at the LSC mode after bootup. Similarly, if you remove the AP LSC provisioning, the APs reboot and join at non-LSC mode.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the management trustpoint to LSC. Example: `Device(config)# wireless management trustpoint trustpoint-name` Example: `Device(config)# wireless management trustpoint microsoft-ca`
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The management trustpoint is now configured for LSC authentication, and access points will join using LSC mode after rebooting.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.