show inventory
show sysinfo
show run-config commands
show interface summary
show interface detailed management
show time
show auth-list
show certificate all
show ap inventory all
show ap join stats summary all

1. Through the CLI via console or SSH:

1. login to the AP using Cisco/Cisco

! 
debug capwap console cli
!
delete /force flash:lwapp_mm_mwar_hash.cfg
delete /force flash:lwapp_reap.cfg
delete /force flash:lwapp_non_apspecific_reap.cfg
delete /force nvram:private-config
clear capwap private-config
!
erase /all nvram:
!
reload

• If you want to reset the access point to its default settings and a static IP address, use the write erase or erase /all nvram command.
• If you want to erase everything including the static IP address, in addition to the above commands, use the erase and erase boot static-ipaddr static-ipmask command.

2. Through the MODE button:

1. Power off the AP
2. While keeping the MODE button pressed, power on the AP.
3. Still keep the MODE button pressed until the Status LED turns to red and then release it.

3. Installing via recovery image:

1. Download the recovery image for 3500 from Cisco site.
2. on AP Console write the command “Debug capwap console cli”
3. Then write the commadn “Archive download-sw /overwrite /reload tftp:///”

Clearing the Controller Configuration on a Cisco Wireless LAN Controller

1. Through the CLI via console or SSH:

1. login to the WLC

! 
clear config
reset system
reload
!

1. Enter clear config and enter y at the confirmation prompt to confirm the action.

2. Enter reset system. At the confirmation prompt, enter n to reboot without saving configuration changes. When the controller reboots, the configuration wizard starts automatically.

3. Follow the instructions in the “Using the Configuration Wizard” section on page 4-2 to complete the initial configuration.

Erasing the Controller Configuration on a Cisco Wireless LAN Controller

1. Through the CLI via console or SSH:

1. login to the WLC

! 
reset system
reload
!

1. Enter reset system. At the confirmation prompt, enter y to save configuration changes to NVRAM. The controller reboots.

2. When you are prompted for a username, enter recover-config to restore the factory default configuration. The controller reboots and the configuration wizard starts automatically.

3. Follow the instructions in the “Using the Configuration Wizard” section on page 4-2 to complete the initial configuration.

WLC error log message: *spamApTask6:  %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:844 Failed to complete DTLS handshake with peer

or:

Failed to complete DTLS handshake with peer 10.32.41.96 for AP 00:1d:45:36:97:30 
*spamReceiveTask: Sep 19 21:42:59.855: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 1.2.3.4 for AP 00:11:22:33:44:55

By default, if an AP and/or WLC certificate has expired, then the DTLS connection will fail. To get around this we had to enable a command in the WLC that ignored the AP cert. The happened because the Manufacturer Installed Certificate (MIC) has now become older than ten years and has expired. To allow AP’s to join a WLC after certificate expiration, upgrade to the fixed software version, then use the following commands:

! For 7.0.252.0:
(WLC)>config ap lifetime-check {mic|ssc} enable

! For 7.4.140.0 and later:
(WLC)>config ap cert-expiry-ignore {mic|ssc} enable

With “config ap lifetime-check {mic|ssc} enable” or “config ap cert-expiry-ignore {mic|ssc} enable” in effect, the WLC and AP will ignore the expiration date on the devices’ MICs and SSCs. The above-noted commands must remain in effect as long as devices with expired MIC or SSC certificates are used.

Solution:

SSH into the WLC and run the following commands:

!on WLC 8.x:
config ap cert-expiry-ignore mic enable
config ap cert-expiry-ignore ssc enable
config ap dtls-cipher-suite RSA-AES128-SHA
config ap dtls-wlc-mic sha2

!on WLC 7.x:
config ap lifetime-check mic enable
config ap lifetime-check ssc enable

if that doesn’t help try

config auth-list ap-policy ssc enable
config certificate ssc hash validation disable