Thanks Tim.
And one more question. I have done a CPSec lab:
1 - I had a controller with one AP associated to it and CPSec disabled. The AP was in up state.
2 - Then I enabled CPSec without Auto Cert Provisioning and got this:
3 - Then I enabled Auto Cert Provisioning and got this:
the AP was in down state. After a few minutes I got this:
and the AP was in up state.
For point 2, under Cert Type tab we can see "factory-cert", which I guess it is a Factory Certificate. When Auto Cert Provisioning is on, the controller sends certificates to all associated APs, however in point 3, under Cert Type tab, we can still see "factory-cert".
Then, if the controller sends certificates to APs, why the AP still has the same Factory Certificate and not the other one sended by the controller?
Regards,
Julián