A method comprising, in response to a controller: receiving radio measurement reports from at least one mesh access point about neighbors (107, 109) of the at least one mesh access point the mesh access points (105, 107, 109) being mesh points of a wireless mesh network, wherein the access point functionality of each mesh access point (103, 105, 107, 109) is controlled by the controller using messages between each mesh access point and the controller using a first protocol, the controller being connected to a root mesh access point that forms the root of the mesh network; determining by the controller a tree topology for the wireless mesh network, including determining a potential child mesh access point and a selected parent mesh access point of the potential child mesh access point; and sending by the controller a JOIN OFFER message to the potential child mesh access point via the selected parent of the potential child mesh access point to offer the potential child mesh access point to join the mesh with the selected parent mesh access point as its parent, at the selected parent mesh access point performing the steps of: forming a secure link to the potential child mesh access point, relaying the JOIN OFFER message to the potential child mesh access point, and receiving a JOIN REQUEST message from the potential child mesh access point as a result of the potential child mesh access point receiving the JOIN OFFER message to join the mesh, so that the potential child mesh access point, by forming a secure tunnel to the controller, and joining the controller via the selected parent mesh access point, can become a child mesh access point of the selected parent mesh access point. receiving radio measurement reports from at least one mesh access point about neighbors (107, 109) of the at least one mesh access point the mesh access points (105, 107, 109) being mesh points of a wireless mesh network, wherein the access point functionality of each mesh access point (103, 105, 107, 109) is controlled by the controller using messages between each mesh access point and the controller using a first protocol, the controller being connected to a root mesh access point that forms the root of the mesh network; determining by the controller a tree topology for the wireless mesh network, including determining a potential child mesh access point and a selected parent mesh access point of the potential child mesh access point; and sending by the controller a JOIN OFFER message to the potential child mesh access point via the selected parent of the potential child mesh access point to offer the potential child mesh access point to join the mesh with the selected parent mesh access point as its parent, forming a secure link to the potential child mesh access point, relaying the JOIN OFFER message to the potential child mesh access point, and receiving a JOIN REQUEST message from the potential child mesh access point as a result of the potential child mesh access point receiving the JOIN OFFER message to join the mesh, by forming a secure tunnel to the controller, and joining the controller via the selected parent mesh access point, can become a child mesh access point of the selected parent mesh access point.