You can console into each AP and perform the archive softare download using the lightweight image from a TFTP server. The good thing about that is that you could script it too, if you know how to. You can also use WCS to upgrade APs, as well as the standalone conversion tool (which does about 6-10 APs at a time). Given that they are 1130 series, they should have MIC (Manufacture Installed Certificates) instead of SSC (Self Signed Certificates) in which case you don't have to rely on the conversion tool to create a hash that has to be imported into your controller for each of those APs to get adopted. Now, when you say remotely, do your APs have a VPN tunnel back to the controller to join and is the round trip time less than 150 ms? If not, the APs won't get the controller reply in time and won't join. New to the 5508 is the ability to use a public IP address on the controller for the join reply (using 'Enable NAT address'), so you can also try it without the VPN tunnel.