topic Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016 in Wireless Questions and Best Practices

Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

michael_brado — Fri, 21 Oct 2016 21:03:50 GMT

Important Notice: AP Device Certificate Refresh

Original Ruckus AP device certificates are due to expire on Nov 27, 2016. Most APs manufactured
in the last two years have new AP certificates installed in addition to the original certificates, but those
which do not, will experience problems communicating with SmartZone controllers.

Latest SmartZone controller code easily identifies APs needing certificate refresh, and a simple process
to send request files to Ruckus and receive/install response files to update the AP certficates is available.

This is a preliminary warning before the original certificate expiration date, to encourage all AP customers
to review the Frequently Asked Questions, and AP Certificate Refresh Flowchart that outlines affected AP
model/serial numbers, impact on SZ, ZD, and Solo APs, and information regarding certificate refresh so
you can avoid them.

KBA-5390: FAQ - Ruckus AP Device Certificate Refresh
https://support.ruckuswireless.com/answers/000005390

KBA-6099: Ruckus AP Certificate Refresh Flowchart
https://support.ruckuswireless.com/answers/000006099

Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

max_o_driscoll — Fri, 21 Oct 2016 21:19:11 GMT

Michael: That got my attention!

Appears it is only Smart Zone that is affected (unless you are going to publish more KBs).
The mention of ZD 9.13 is only in reference to it's ability to notify that APs require a new certificate.

So those of us (ye olde legacy types on ZD hardware controllers) seem unaffected - I am right in this or did I miss something?

Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

michael_brado — Fri, 21 Oct 2016 21:23:11 GMT

Yes, latest ZD 9.13.x will identify APs needing new certificates, but AP/ZD communication is not affected.
However, many current ZD customers might be planning migration to SmartZone.
Similarly for Solo APs, browsers will still present a certificate warning, that you can allow/add exception to continue.

Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

jukka_somiska — Tue, 01 Nov 2016 07:42:42 GMT

This certificate refresh seems to be problematic for customers, who are running VSZ-H with both new and legacy APs (eg. 7363) set to different AP zones running different firmware versions. Apparently one solution is to disable certificate check, but how does this affect security of the system?

Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

lex_jonkers — Tue, 01 Nov 2016 10:52:57 GMT

According to the flowchart for ZoneDirectors there is no impact, but cert refresh is recommended in case of future migrations.

However how does one refresh when using zd1100's as 9.13 isn't available for them and the options used in the refresh procedure in the faq are not present in 9.10.1?

Is it possible or are zd1100 users out of luck since they are EOL?
And if so guess the procedure on migration would be: Disable cert check in smartzone cli, connect AP's, update cert, enable cert check again?

Re: Important Notice: Ruckus AP Device Certificate Refresh - Check/Update APs before Nov 27, 2016

ivan_gonzalez_g — Tue, 11 Apr 2017 15:11:17 GMT

Hi,

Good day,

I perform the steps that Ruckus recommends but I do not update the certificates of AP R300 and T300.

When you perform the steps you recommend to replace the certificate, the same message still appears and there is no update of this certificate: "Reminder: Some of your APs need to have their Certificate replaced by November 2016. Until then those APs will continue to operate as -is with NO OPERATIONAL impact. You may go to Administration> AP Certificate Replacement and follow the Refresh Process any time before November 2016. Please visit https://support.ruckuswireless.com/certificate for details. "

Thanks