topic ISE 1.1.4 Can't run multiple signed CA's in the store in Network Access Control

ISE 1.1.4 Can't run multiple signed CA's in the store

desmanicholson — Mon, 11 Mar 2019 03:30:56 GMT

Using Sha1 for Cisco 7925g and sha256 for data. Two separate CA's, one EnTrust (SHA1) the other Local Wondows CA (SHA256); ISE can only use one at a time to process a particular protocol (ie..EAP-TLS, HTTP, etc...)

As a result we have to have a separate PSN just for Wireless and Wired VoIP (which can only hold SHA1 RSA1024).

Has anyone else run into this issue?

The box said 'Requires Windows XP or better'. So I installed LINUX...

ISE 1.1.4 Can't run multiple signed CA's in the store

Richard Atkin — Thu, 06 Jun 2013 06:37:41 GMT

It is correct that you can only have one Cert for EAP and one for HTTPS; this is the case for all 1.1.X versions of ISE.

Why don't you just use one Cert for all of your EAP functions?

ISE 1.1.4 Can't run multiple signed CA's in the store

Jatin Katyal — Thu, 06 Jun 2013 08:43:52 GMT

I guess you're using 2 different CA's becuase you want to use certificate signed with SHA256 RSA signature however IP phones 7925 doesn't support or work with SHA256 so you want to use SHA1 for phones only. We had this discussion in the below listed link: https://supportforums.cisco.com/thread/2165566

Yes, ISE can use only one cert for eap chaining and one for https.

Jatin Katyal
- Do rate helpful posts -

ISE 1.1.4 Can't run multiple signed CA's in the store

desmanicholson — Thu, 06 Jun 2013 12:27:00 GMT

Thanks for the response, unfortunately policy doesn't allow for mixed mode (ie..sha1 for 7925's and sha256) for data. since the 7900 series wired and 7925g wireless can run sha256 we had to find a 3rd party hosted pki solution. Spoke with a Cisco ISE Engineer and he verified the configurations aren't granular enough to be able to direct traffic to the proper cert and protocol. The one that's active is the one that will be used.

Cisco 7925 wireless new model that can acept a sha256 isn't coming until 2014 so i've heard and now sure when the wired desktop units will be able to handle sha256. Kinda leaves you in a pickle when architecting because it adds 2 PSN's automatically for HA/DR

The box said 'Requires Windows XP or better'. So I installed LINUX...

ISE 1.1.4 Can't run multiple signed CA's in the store

desmanicholson — Thu, 06 Jun 2013 12:27:35 GMT

That is exactly correct..Thanks for the link, I will check it out...

The box said 'Requires Windows XP or better'. So I installed LINUX...

ISE 1.1.4 Can't run multiple signed CA's in the store

Jatin Katyal — Sat, 08 Jun 2013 09:24:30 GMT

anytime. keep this thread updates if you face any further issues.

Jatin Katyal
- Do rate helpful posts -