An engineer has all of the remote locations using a pair of FlexConnect WLCs with locally switched WLANs and must leverage local certificate based authentication. Which component must be configured?

Configuring APs in FlexConnect Central Auth mode allows the AP to act as an 802.1X authenticator while forwarding EAP exchanges to the WLC, which communicates with the central RADIUS server - this is required for certificate-based EAP methods like EAP-TLS to function in a FlexConnect locally switched WLAN deployment.

Manually installing certificates on APs is not a supported or required step for enabling certificate-based client authentication in FlexConnect mode.

Uploading a vendor certificate to the WLC is not the configuration needed to enable local certificate-based authentication for FlexConnect locally switched WLANs.

LDAP integration with the WLC supports username/password authentication lookups and does not provide certificate-based EAP authentication for FlexConnect deployments.