A Catalyst 9800 was set by typing the local time into the clock as if it were UTC, so the clock is hours off. New certificates fail their validity checks. What should be corrected?
Select an answer to reveal the explanation.
Short Explanation
The controller thinks local time is UTC, so it is hours off, and your new certificates fall outside the window it believes. Fix the clock from a real time source. A guest password is not a clock.
Full Explanation
Certificate validity is checked against the device clock. This controller was given local time in a field that is UTC, so it is hours off and new certificates fail their checks. Correct the clock. A guest passphrase is not a time source. The beacon interval does not shift the clock. The client VLAN does not have to match an hour offset. Certificates do not consult the VLAN to learn what time it is. The controller clock was set as if local time were UTC, so it is hours off. Certificate checks fail. Set the clock from a real time source. Check one live client after the change and leave the rest of the floor alone until that client matches the result you expected. Read the live counters after you retest. Exam caveat: fixing the clock can make a certificate that was wrongly accepted start to fail, or the reverse. After the time is right, recheck both the controller certificate and the RADIUS certificate. Operational check: set the clock from a trusted time source, confirm the offset is gone, and retry a certificate that should be valid.