6.5.18 Aruba Mobility Controller

The Aruba templates connect to a Mobility Controller or Mobility Conductor over SSH, upload the certificate using SCP, update the service binding, and save the configuration.

To use the certificate for both services, configure both templates. The second deployment reuses the installed certificate and updates the other service binding. Schedule restarts with a deployment window.

Controller requirements

• ArubaOS 8.2 or later in the 8.x release line. The templates reject other versions, including AOS 10.
• SSH access from the agent’s computer. If SSH isn’t on port 22, add the port to Controller / Conductor hostname or IP (optionally :port).
• SCP enabled. The templates use SCP to upload the certificate.
• An administrator with the root role, entered in ArubaOS administrator username and ArubaOS administrator password. When it signs in over SSH, it must land at the # prompt. Accounts that land at > or are asked for an enable password won’t work.

Turn on SCP from the controller’s command line, then check it:

configure terminal
service scp
end
write memory
show scp

Install Posh-SSH on the agent host

The templates need the Posh-SSH PowerShell module, version 3.2.7 or later. The agent runs as Local System, so install it for all users from an administrator PowerShell prompt:

Install-Module -Name Posh-SSH -Scope AllUsers -Repository PSGallery -Force

Configuration node

Set Configuration node to the scope you want to update in the Mobility Conductor hierarchy:

• none for a standalone controller.
• /mm/mynode for the Conductor’s own WebUI or captive portal.
• /md for every managed device.
• /md/<group> for one group. Use the path shown in the Conductor’s configuration hierarchy.

Certificate overrides on child groups or devices remain in place. Add a separate deployment for each node with an override you want to update.

After a successful deployment, CertKit deletes older copies of this certificate that it installed at that node. It never deletes certificates it didn’t install, or ones still in use.

Captive portal hostname

Guests are sent to the name on the captive portal certificate. Issue the certificate for a name that guest devices resolve to the controller. Otherwise guests see name warnings or can’t reach the login page.

Common problems

• “Posh-SSH PowerShell module is not installed” or “requires Posh-SSH 3.2.7 or later”: install or update Posh-SSH with -Scope AllUsers. The agent can’t see a -Scope CurrentUser install.
• “SSH connection … failed”: check that the agent’s computer can reach the controller over SSH and that the username and password are right. If the controller was replaced or its SSH key changed, delete C:\Windows\System32\config\systemprofile\.poshssh\hosts.json on the agent’s computer and deploy again.
• “The SSH account landed in user mode” or “asked for a password inside the CLI session”: use an administrator with the root role. Enable passwords aren’t supported.
• “requires ArubaOS 8.2 or later in the 8.x release line”: the controller runs a version the templates don’t support.
• “is not a valid configuration node path” or “Changing to configuration node … failed”: enter none for a standalone controller, or a path that exists, such as /md, /md/<group>, or /mm/mynode.
• “Could not upload … over SCP”: run show scp and turn on SCP if needed. Check that the account is allowed to use SCP.
• “crypto pki-import failed” or “The PFX password must contain only ASCII letters and digits”: the error includes the controller’s own message. For password problems, leave the PFX password file path as CertKit filled it in. CertKit’s generated password uses only letters and digits.
• “Imported certificate … has thumbprint …, but the PFX has thumbprint …”: a different certificate with the same name is already at that node. Remove it with no crypto-local pki ServerCert <name> in configuration mode, or deploy a different CertKit certificate.
• “Could not determine the current switch-cert” or “captive-portal-cert”: run show web-server profile at that node. CertKit won’t change a setting it can’t put back.
• “still reports … certificate … instead of …”: the change didn’t take effect at that node. The error includes the show web-server profile output.
• “Timed out … waiting for the ArubaOS prompt”: the session stopped at a prompt CertKit didn’t expect. The error shows what the controller printed.
• Old certificate “not deleted (probably still referenced elsewhere)”: another profile still uses it. The deployment still worked. Delete it by hand if you no longer need it.