Anyone have an answer for this?

Do a show ver and look at what radio module your have.... that is probably why you are not able to configure wpa2.  Doesn't matter if the code supports it if the radio doesn't.

cisco AIR-AP1121G-A-K9     (PowerPCElvis) processor (revision A0) with 15138K/1236K bytes of memory.
Processor board ID ************
PowerPCElvis CPU at 197Mhz, revision number 0x0950
Last reset from power-on
1 FastEthernet interface
1 802.11 Radio(s)

Here it is. Is this not the right one? Is there a particular model I need?

On the CLI, run: show controllers dot11Radio0 and post that info.

Here you go, thank you!

ap2#sh controller dot11radio0
!
interface Dot11Radio0
Radio AIR-MP21G, Base Address 000f.24e4.1fb0, BBlock version 0.00, Software vers
ion 6.11.6
Serial number: ********
Number of supported simultaneous BSSID on Dot11Radio0: 8
Carrier Set: Americas (US )
Uniform Spreading Required: No
Current Frequency: 2447 MHz  Channel 8
Allowed Frequencies: 2412(1) 2417(2) 2422(3) 2427(4) 2432(5) 2437(6) 2442(7) 244
7(8) 2452(9) 2457(10) 2462(11)

Listen Frequencies: 2412(1) 2417(2) 2422(3) 2427(4) 2432(5) 2437(6) 2442(7) 2447
(8) 2452(9) 2457(10) 2462(11) 2467(12) 2472(13) 2484(14)
Beacon Flags: 0; Beacons are enabled; Probes are enabled
Current CCK Power: 100 mW
Allowed CCK Power Levels: 1 5 10 20 30 50 100
Current OFDM Power: 30 mW
Allowed OFDM Power Levels: 1 5 10 20 30
Allowed Client Power Levels: 1 5 10 20 30 50 100
ERP settings: short slot time.
Neighbors in non-erp mode:

Current Rates:  basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0
36.0 48.0 54.0
Active Rates:  basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 3
6.0 48.0 54.0
Allowed Rates:  1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0
Best Range Rates:  basic-1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0
Best Throughput Rates:  basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-
11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
Default Rates:  basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0
36.0 48.0 54.0
Current Voice Rates:  5.5 6.0 11.0 12.0 24.0 [disabled until voice packet-discar
d enabled]
Default Voice Rates:  5.5 6.0 11.0 12.0 24.0
Channel / Max Power Table
  1 O=15 D=20,    2 O=15 D=20,    3 O=15 D=20,    4 O=15 D=20,    5 O=15 D=20
  6 O=15 D=20,    7 O=15 D=20,    8 O=15 D=20,    9 O=15 D=20,   10 O=15 D=20
11 O=15 D=20

Data Rate Sensitivity (rate, SNR dB, Contention dBm)
( 1.0,  1, -98)   ( 2.0,  7, -94)   ( 5.5,  9, -92)   (11.0, 16, -86)
( 6.0,  7, -92)   ( 9.0, 14, -87)   (12.0, 12, -87)   (18.0, 15, -84)
(24.0, 17, -82)   (36.0, 24, -76)   (48.0, 29, -73)   (54.0, 33, -69)
Radio Management (RM) Configuration:
Regular AP RM Mode 1   Temp Setting Disabled
Temp  Settings: AP Tx Power 0    AP Tx Channel 0    Client Tx Power 0
      Rates:
Saved Settings: AP Tx Power 0    AP Tx Channel 8    Client Tx Power 0
      Rates:

MCST RSCs: [0]0x0 [1]0x0 [2]0x0 [3]0x0 [4]0x0
TKIP Cum Stats: STA            MIC-L-Errs MIC-R-Errs Replay   C-Measure
                0000.0000.0000 00000000   00000000   00000000 00000000
AES-CCMP Cum Stats: 00000000 replays discarded

QBSS Load: 0x5B
Policing Stats:Rx downgardes 0, Tx downgrades 0

Configured Local Access Class Parameters
  Back      : cw-min 4 cw-max 10 fixed-slot 7 admission-control Off txop 0
  Best      : cw-min 4 cw-max 6 fixed-slot 3 admission-control Off txop 0
  Video     : cw-min 3 cw-max 4 fixed-slot 1 admission-control Off txop 3008
  Voice     : cw-min 2 cw-max 3 fixed-slot 1 admission-control Off txop 1504
Configured Cell Access Class Parameters
  Back      : cw-min 4 cw-max 10 fixed-slot 7 admission-control Off txop 0
  Best      : cw-min 4 cw-max 10 fixed-slot 3 admission-control Off txop 0
  Video     : cw-min 3 cw-max 4 fixed-slot 2 admission-control Off txop 3008
  Voice     : cw-min 2 cw-max 3 fixed-slot 2 admission-control Off txop 1504
Transmit queues: Active 0 In Progress 0
       ---- Active --- In-Progress --------------- Counts --------------
       Cnt Quo Bas Max Cnt Quo Bas       Sent   Discard  Fail   Retry Multi
Uplink   0   0   0   0   0   0   0          0         0     0       0     0
Voice    0   0   0   0   0   0   0        301         0     0       4     0
Video    0   0   0   0   0   0   0          0         0     0       0     0
Best     0   1  70   1   0   1  24          1         0     0       0     0
Mcast    0   0   0   0   0   0   0          0         0     0       0     0
Back     0   0   0   0   0   0   0          0         0     0       0     0
BSSIDS Index Flags State Next Held Defer NonDefer Clients Tsf Dtim Txq
  1FB0     0    20     0    0    0     0        0       0   0    2   0
UP ClientQAged    AcQAged PacketAged Drop  Retry/Thresh Timeout CQMax
7           0          0          0       3/100  0/500      35     4
6           0          0          0       3/100  0/500      35     4
5           0          0          0       3/100  0/500      35     4
4           0          0          0       3/100  0/500      35     4
3           0          0          0       3/100  0/500      35     4
2           0          0          0       3/100  0/500      35     4
1           0          0          0       3/100  0/500      35     4
Driver TX blocks: in use 0, high 2, at reset 0, fail 0, reclaim 0
Clients: 8021x auth in prog 0 allowed 0
Vlan BSSID   Clients PSP Pri Encr  Key0 Key1 Key2 Key3 SSIDs
   0n 1FB0 0       0   0   0  214
0 0 flags 3
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
0 0 flags 0
17 0 flags 1
18 0 flags 0

Registers: io E8000000 mem 80000000 aux A0000000
0000 FF50 0000 0000 0021 0000 0000 0000
0001 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0500 0007 0000 0000 0808 09E8 0000 0504
0000 0000 0000 0000 0116 003C 0218 930B
00000000 20E00024 C8000080 DFCEB59F FBFFFBEB 00000000 00081000 02000062
FFFFFFEA 00000FFF F8D36E1D 2000417D 00000000 00000000 00008000 00008080
00000000 00000000 00000000 00000000 00002D46 00006620 00000000 0000EE26
Radio running:  temp 0 C tx_power 100 bb_code 0x0
    rssi_threshold 0x0 gain offset 0

Antenna: internal , gain 20 (platform 0, domain class A)
PCI sys_id: 0xA506 subsys_id 0x5100 (0x5101)

Unicast ciphers 0x1 mcast ciphers 0x1
Rid Ring:
A0000970: 00AA8000 20ED1EA0 * n
Rx Ring:
A0000950: 893E0002 20EDE40C   v, 893E0002 20EDC510 * v
A0000960: 893E0002 20EDCF64   v, 893E0002 20EDD9B8   v
Tx Ring:
A0000800: 00B58000 20ECD754   n, 00B58000 20ECF054   n
A0000810: 00B58000 20ECCDF4   n, 00368000 20ECBB14   n
A0000820: 003A8000 20ECB3F4   n, 009E8000 20ECE3F4   n
A0000830: 00B58000 20ECF694   n, 00B58000 20ECE0B4   n
A0000840: 00B58000 20ECF374   n, 00368000 20ECB524   n
A0000850: 003A8000 20ECC364   n, 009E8000 20ECDDB4   n
A0000860: 00B58000 20ECD754   n, 00B58000 20ECF054   n
A0000870: 00B58000 20ECCDF4   n, 00368000 20ECC104   n
A0000880: 00B58000 20ECCDF4 * n, 00368000 20ECC5C4   n
A0000890: 003A8000 20ECCBB4   n, 009E8000 20ECE3F4   n
A00008A0: 00B58000 20ECF694   n, 00B58000 20ECE0B4   n
A00008B0: 00B58000 20ECF374   n, 00368000 20ECCCE4   n
A00008C0: 003A8000 20ECC234   n, 009E8000 20ECDDB4   n
TxDn Ring:
A0000930: 802C0000 20ED26A0   v, 802C0000 20ED2778   v
A0000940: 802C0000 20ED2850 * v, 802C0000 20ED2928   v
Multicast counters:
Internal MC counts:
0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0 (0) 0
(0) 0 (0) 0 (0)
Log Buffer:

ap2#

That radio does support WPA2, so what I would do is wipe the config and upgrade to 12.3(2)JA and configure the basic and see if WPA2 is an option.  I know you have upgraded, but try this version since it is the minimum... then you can upgrade to whatever code you need.

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008054339e.shtml