Skip to end of metadata
Go to start of metadata


Description:
This document describes how to use a LANCOM WLAN controller with the One Click Backup feature to backup existing certificates and then transfer them to another LANCOM WLAN controller. This can be useful, if for example, an existing WLAN Controller is to be replaced by a new one.


Requirements:

How you transfer certificates between WLAN controllers with a firmware version older than LCOS 9.0 is described in this Knowledge Base article.




Procedure:

1) Steps to carry out on the source device:

1.1) Creating the One Click Backup:
On the LANCOM WLAN controller containing the certificates, you first perform a backup to the CA (certification authority). The backup is stored on the WLAN controller.
  • Open a CLI session via SSH on the WLAN controller and run following command:
    do /Setup/Certificates/SCEP-CA/CA-certificates/Create-PKCS12-Backup-Files <password>

At this point you set the <password> to a password of your choice. The password is required because it is only possible to upload certificate containers to a LANCOM device if a password has been set.

You then enter the command ls /Status/File-System/Contents. This allows you to check whether the backup files were successfully created. The following files should appear in the list:

  • scep_ca_backup
  • scep_ra_backup


1.2) Exporting the "One Click Backup":
1.2.1) Exporting the "One Click Backup" via LANconfig:
1.2.1.1) Mark the WLAN Controller in LANconfig, perform a rightclick, and in the context menu select Configuration Management → Save Certificate as File.
1.2.1.2) Choose a folder location, edit the File Name if necessary and select the option Option SCEP-CA - One Click Backup as Certificate. Click Save afterwards.

1.2.2) Exporting the "One Click Backup" via WEBconfig:
Open the configuration of the WLAN Controller in a web browser, go to the menu (Extras) → File Management → Download Certificate or File and select the option SCEP CA - One click Backup as File Type.
Click Start Download afterwards and save the backup to the desired folder.


2) Steps to carry out on the target device:

The new WLAN Controller has to be in factory state! If the device was already configured or the backup of the old WLAN Controller was uploaded, the device has to be reset to factory state.

2.1) Uploading the "One Click Backup":
2.1.1) Uploading the "One Click Backup" via LANconfig:
2.1.1.1) Mark the WLAN Controller in LANconfig, perform a rightclick, and in the context menu select Configuration Management → Upload Certificate or File.
2.1.1.2) Select the SCEP-CA - One Click Backup file, select the option SCEP-CA - One Click Backup as Certificate and enter the Cert. password (see step 1.1). Click Open afterwards to upload the backup to the device.

2.1.2) Uploading the "One Click Backup" via WEBconfig:
Open the configuration of the WLAN Controller in a web browser, go to the menu (Extras) → File Management → Upload Certificate or File and select the option SCEP CA - One click Backup as File Type
Afterwards select the backup at File Name/Location and enter the Passphrase for the One Click Backup (see step 1.1).
Then click Start Upload.


2.2) Uploading the script configuration of the old WLAN Controller into the new device:

The main device password isn't included in a script configuration and therefore has to be set manually after importing the script.

2.2.1) Uploading the script configuration via LANconfig:

2.2.1.1) Mark the WLAN Controller in LANconfig, perform a rightclick, and in the context menu select Configuration Management → Restore Script from File.
2.2.1.2) Select the script backup and click Open.

2.2.2) Uploading the script configuration via WEBconfig:
Open the configuration of the new WLAN Controller in a Web browser, go to the menu (Extras) → File management → Execute Configuration Script, select the script backup and click Start Upload


2.3) Reinitializing the SCEP Client:
2.3.1) Reinitializing the SCEP Client via the CLI:
Connect to the WLAN Controller via the CLI and enter the following command:
do /Setup/Certificates/SCEP-Client/Reinit

2.3.2) Reinitializing the SCEP Client via WEBconfig:
In WEBconfig go to the menu (Extras) → LCOS Menu Tree → Setup → Certificates → SCEP-Client → Reinit and click Execute.