Before onboarding new AOS-CX switches in the hospital's biomedical engineering lab, the technician plans to enroll them with certificate-based device authentication to Aruba Central. Which prerequisite must be verified first for that certificate validation to succeed?
Select an answer to reveal the explanation.
Short Explanation
Certificates aren't just strings of text — they have a validity window, a "not before" and "not after" date baked in. If a switch thinks it's still 2019 because nobody set up NTP, it'll reject a perfectly good certificate as expired or not-yet-valid. Get the clock right before you ever touch trust.
Full Explanation
Certificate-based authentication relies on comparing the certificate's validity window against the device's own notion of the current time, so a switch with a badly skewed clock will refuse to trust an otherwise valid certificate, or present one that Central's validation logic rejects as invalid. Synchronizing every switch to a reliable NTP source before certificate exchange begins is therefore a hard prerequisite in the planning stage, not something to troubleshoot after enrollment fails. A guest VLAN for visiting vendor laptops is a segmentation concern for client traffic and has no bearing on how a switch validates its own management-plane certificate. Requiring direct cabling to the core router ignores how campus networks are actually built with distribution and access tiers, and certificate exchange works fine across intermediate hops as long as IP reachability and DNS to Central exist. Disabling spanning tree on uplinks is actively risky in a lab that likely has redundant paths, and it addresses loop prevention, not time synchronization or trust establishment. A quick operational check before rollout is to confirm each switch's clock against a known-good reference and that its NTP servers are configured and reachable.