Certificate install issue WLC DNA

[glsparks]

For some reason one of our pair of WLC 9800 will not accept DNAC-CA certificate.

A sync or push of telemetry from DNA fails. All our other devices are fine.

If we try a CLI import of the certificate we get this:

Trustpoint 'DNAC-CA' is a subordinate CA.
Authentication failed - could not validate certificate
% Error in saving certificate: status = FAIL

Any ideas why this is happening on this one device?

[rasmus.elmholt]

Do you have port http/80 open from the WLC to the DNAC?

[glsparks]

Yes the port is open. A debug isn't giving anything useful either unfortunately.

[LC.IT]

Did you configure default aaa methods for authentication and authorization on C9800?

aaa authentication login default local (or group)
aaa authorization exec default local (or group)

[glsparks · Accepted solution]

Finally figured this out after some extensive debugging. Basically it was two issues. The WLC was unable to do a Certificate Revocation check and the full cert chain was not in the cert being uploaded. Once they were addressed it uploaded fine.

[Captain82]

How did you address/fix those issues?

[glsparks · Accepted solution]

As I recall it i deleted the existing trustpoint DNAC-CA.

Recreated it with the line "revocation-check crl none" e.g.

crypto pki trustpoint DNAC-CA
enrollment mode ra
enrollment terminal
usage ssl-client
revocation-check crl none
source interface GigabitEthernet0

Then manually imported the full cert chain.

DNA error then cleared and telemetry came in.