We have a remote branch office that is served by a 2106 controller. We want to use the main campus WiSM's as the failover location for the ap's. We are unable to get either ap to join the controller on the Main campus. Both ap's at the local campus have manufacturer signed certificates. I've attempted to force the ap's to the failover controllers, but no luck. The controllers are communicating L3 and are in the same mobility group across the WAN link as well as pingable, both the data path and mobility path are up. What else might I look at?