Ruckus's original Device certificates expired in November 2016. Any device manufactured prior to Nov 2016 will have the old certificate.
Log in to the AP CLI (SSH) and run the following command:
rkscli: get rpki-cert issuer
The AP with the below output will not join the controller as it has an old certificate.
Issuer: Ruckus Wireless, Inc. OK
vSZ/SZ prior to firmware 3.6.x release doesn’t have AP-cert check enabled by default.
Hence the AP which joined the controller prior to 3.6.x and got upgraded to 3.6.x or above will have the below error message/warning on the controller Dashboard.
Export the All AP Certificate file from the controller (below screenshot is from the older version pre-5.x and 3.6.x): -
Screenshot from the updated (above 3.6.x) vSZ/SZ firmware version: -
It lands on the below page: