A manufacturer finds that new access points can reach the Catalyst 9800 but cannot finish the secure join. The certificate the controller presents for that join is past its end date. Which maintenance action fixes the join?
Select an answer to reveal the explanation.
Short Explanation
The access points are willing to talk, and the ID the controller shows them is expired. Renew that certificate. Your beacon timer does not extend a date on a certificate, and monitor mode will not skip the check.
Full Explanation
The secure join between a Cisco access point and a Catalyst 9800 depends on a certificate the controller presents. When that certificate is past its end date, discovery can still find the controller and the join still fails the security check. Renewing the certificate is the maintenance action that matches the symptom. The beacon interval is how often an access point that is already serving advertises a BSS. New access points that have not joined are not failing because of beacons, and a shorter interval does not change a certificate date. Monitor mode is a scanning mode for an access point that has joined. It does not skip certificate validation, and these access points are not joined yet. Site tags are pushed after a join. Deleting them does not remove the certificate from the join handshake, and it would strip site configuration from access points that are already up. Exam caveat: renew the certificate the join actually uses, and confirm the clock is sane, because a correct certificate still fails if the controller time is outside the validity window. Operational check: check the certificate end date, install a current certificate, and watch a new access point complete the join.