Backing Up The Certificates - Lancom WLC-4006 Manual

LANCOM WLC series
Chapter 4: Configuring the WLAN Controller
If the connection to a deactivated Access Point is broken
(either unintentionally due to a failure or intentionally by the administrator)
then the Access Point begins a new search for a suitable WLAN Controller.
Although the former WLAN Controller can check the validity of the certificate,
due to the fact that there is no (active) entry in the AP table, it is treated as a
secondary WLAN Controller by the Access Point. If the Access Point finds a
WLAN Controller then it will register with it.
Permanently removing Access Points from the WLAN infrastructure
In order to permanently remove an Access Point from a centrally managed
WLAN infrastructure, the certificates in the SCEP client have to be either
deleted or revoked.
4.3.3

Backing up the certificates

At system startup, a LANCOM WLAN Controller generates the own basic cer-
tificates for the assignment of certificates to the Access Points, including the
root certificates for the CA (Certification Authority) and the RA (Registration
Authority). Based on these two certificates, the WLAN Controller issues device
certificates for the Access Points.
If multiple WLAN Controllers are employed in parallel in the same WLAN infra-
structure (for load balancing) or if a device is being replaced or reconfigured,
the same root certificates must always be used to avoid problems operating
the managed Access Points.
Create backups of the certificates
To restore the CA or RA, the relevant root certificates with private keys will be
required as generated automatically when the LANCOM WLAN Controller was
started. Furthermore the following files with information on issued device cer-
tificates should also be backed up ('Backing up and restoring further files from
82
If you have access to the Access Point, the certificates are quickly deleted
by resetting the device.
If the device has been stolen and consequently needs to be removed from
the WLAN infrastructure, then the certificates in the WLAN Controller's CA
have to be revoked. This is done in WEBconfig by changing to Status
Certificates SCEP- CA
status table. Here you delete the certificate for the MAC address of the
Access Points which are to be removed from the WLAN infrastructure. The
certificates are not actually deleted, but they are marked as expired.
Certificates and accessing the Certificate