Can I generate new SSC on LWAPP?

Answered Question
Mar 9th, 2010


We have had some LWAPP recycled back into our network after clearing them using 'clear lwapp private-config'

However, when they come back up they are not associating with our controllers correctly and this is the log entry:

'Failed to authorize AP with Base Radio MAC 00:12:80:3f:40:f6. Authorization key  does not match with SHA1 key in Controller's AP Authorization List.'

I have searched for this string and found the following advice on this link



MIB Name


WCS Message

Failed to  authorize AP "{0}". Authorization entry does not exist in Controllers "{1}" AP  Authorization List.

Failed to  authorize AP "{0}". AP's authorization key does not match with SHA1 key in  Controllers "{1}" AP Authorization List.

Failed to  authorize AP "{0}". Controller "{1}" could not verify the Self Signed  Certificate from the AP.

Failed to  authorize AP "{0}". AP has a self signed certificate where as the Controllers  "{1}" AP authorization list has Manufactured Installed Certificate for this AP.


An alert is generated when an access point fails to associate  with a controller due to authorization issues.

WCS Severity


Probable Causes

The access point  is not on the controller's access point authorization list.

The key entry in  the controller's access point authorization list does not match the SHA1 key  received from the access point.

The access point  self-signed certificate is not valid.

The access point  has a self-signed certificate and the controller's access point authorization  list (for the given access point) references a manufactured installed  certificate.

Recommended Actions

Add the access  point to the controller's authorization list.

Update the  access point's authorization key to match the controller's access point key.

Check the  accuracy of the access point's self-signed certificate.

Check the  certificate type of the access point in the controller's access point  authorization list.

It says to update the access point's authorisation key to match the controllers access point key....does anyone know how to do this?



I have this problem too.
0 votes
Correct Answer by Kayle Miller about 6 years 7 months ago


     You can get the SSC hash off the LWAPP AP, and just input it into the controller and then it will attach, the document below should cover how to get the existing SSC SHA1 Hash off the AP

Hope this helps.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
dancampb Tue, 03/09/2010 - 06:40

To generate a new SSC you will need to convert that AP to IOS and then use the LWAPP Upgrade Tool to convert them back to LWAPP.

BRYN JONES Tue, 03/09/2010 - 06:46

thank you, I was hoping this wasn't going to be the answer, but if it is, then I'll get to it




This Discussion