topic Re: ISE can not Import Server Certificate in Network Access Control

ISE can not Import Server Certificate

huang zhongwei — Mon, 11 Mar 2019 02:25:42 GMT

I want to use 802.1x EAP-TLS protocol authenticate client,then requested web server certificate from Microsoft 2003 CA server and saved it to my PC, when I open local Certificates>Import Server page in ISE , there is "Private Key File" item,but I don't know how generate this file.

In addition,after I Submit,ISE prompt "Unable to read certificate file - please be sure file is in PEM or DER format".

Anyone tell me how procedure I do,truly grateful.

ISE can not Import Server Certificate

Tarik Admani — Wed, 15 Aug 2012 04:18:40 GMT

Hi,

If you generated the CSR on the ISE node locally, you are choosing the wrong option. Please use the "Bind CA Signed Certificate" option instead. The private key is generated already when you created the CSR on the ISE.

As far as your 2nd question what are you doing to get this error? Are you generating a bogus private key file and trying to import this?

Thanks,

Tarik Admani
*Please rate helpful posts*

ISE can not Import Server Certificate

Venkatesh Attuluri — Thu, 18 Jul 2013 09:24:44 GMT

Steps for configuring certificate in ISE

Step 1 :Download the CA’s certificate

Step 2 :Trust the CA in ISE a. In ISE, go to Administration > System > Certificates > Certificates Authority Certificates

b. Add the CA certificate as a trusted certificate

Step 3: Create a certificate signing request (CSR)

Go to Administration > System > Certificates > Local Certificates, and click Add

b. Generate a certificate signing request

c. Export the CSR from Administration > System > Certificates > Certificate Signing Requests

d. Once saved, open the .PEM file with notepad and copy the entire contents to the clipboard.

Step 4: Submit the CSR to the CA for signing

Step 5: Bind the certificate to the signing request

a. In ISE, go to Administration > System > Certificates > Local Certificates and add the certificate by binding the certificate.

Step 6 :Confirm that the new ISE certificate is being used

a. Log out of ISE and close all browser windows

b. Reopen the browser and go to the ISE login page. Confirm that the browser is securing the https session using the new ISE certificate.

Re: ISE can not Import Server Certificate

kevink707 — Fri, 26 Jan 2018 18:26:24 GMT

Can you clarify what you mean by, "Step 5: Bind the certificate to the signing request"? Note I am using ISE 2.3.

Re: ISE can not Import Server Certificate

kevink707 — Fri, 26 Jan 2018 18:31:37 GMT

I found the answer -- after you generate a CSR request you need to load the certificate on the "Certificate Signing Requests" page (by selecting Bind Certificate) rather than trying to import it as a new certificate on the "System Certificates" page.

Cisco could make this more intuitive.....

Re: ISE can not Import Server Certificate

mohannad87 — Wed, 01 Jan 2020 11:45:20 GMT

good.

when I`m trying to do Step 5: Bind the certificate to the signing request.

this error appear " Certificate path validation failed. make sure required Certificate chain is imported under Trusted Certificates "

Re: ISE can not Import Server Certificate

Damien Miller — Thu, 02 Jan 2020 03:54:04 GMT

You need to import the root and any intermediate certificates that are in the certificate chain of the signed / generated certificate.

You do this under the "Trusted Certificates" menu/page on the primary admin node.

Re: ISE can not Import Server Certificate

Analistaredes — Sat, 08 Jul 2023 23:06:58 GMT

My friend,

How can do it: Step 4: Submit the CSR to the CA for signing?

I am using 2.7 version ISE.

Re: ISE can not Import Server Certificate

Greg Gibbs — Sun, 09 Jul 2023 22:03:32 GMT

See the information and examples provided in How To Implement Digital Certificates in ISE.

If there is something additional you are having trouble with, please provide more detail on what help you require.