topic Re: Replaced Expired Cert on ACS in Network Access Control

Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Mar 2019 00:37:55 GMT

Hi,

I replaced an ACS certificate that had been installed i then did the following:

1. Created a certificate request.

2. Issued the request to the enterprise CA.

3. Copied the certificate to an ftp server.

4. Installed the certificate on the ACS.

5. Configured the CTL again.

6. Restarted the ACS service.

8. Enable EAP-TLS.

The problem is when i try and enable EAP i get the message no ACS certificate installed.

I searched on cisco and it said to disable the CSA and follow the same process which i have done to no avail.

Any help appreciated.

Thanks

Kev

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Tue, 12 Feb 2008 17:40:47 GMT

Kev,

Make sure you have installed server cert on acs. Do you see the server cert if you check acs--->system configuration--->acs cert setup--->Install certificate.

It seems that you have not installed the correct certificate at the above location. The most command mistake is to install CA in the place of server cert.

Regards,

~JG

Do rate helpful posts

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 09:59:11 GMT

JG,

I have definately installed it in the place were you suggested. It is like the server is just ignoring the certificate.

This is the windows based soloution engine.

Thanks

Kev

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 11:51:37 GMT

I have done some more investigation and it turns out the CA certificate had been renewed a few days ago on the CA. I have now installed the valid cert on the ACS but i am still getting the same issue.

Cheers

Kev

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Wed, 13 Feb 2008 13:58:48 GMT

Which vendor certificate is it ?

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 14:40:47 GMT

It is an internal CA issuing certificates.

Cheers

Kev

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 15:36:10 GMT

I found this book in the version of the ACS:

CSCef61785 Bug Details Bug #79 of 92 | < Previous | Next >

ACS Appliance fails to recognize installed certificate Symptom

ACS appliance does not recognize the installed certificate.

Conditions

Cisco Security Agent is running.

1. Install a certificate. The web interface will report the certificate as installed and validated.

2. Enable PEAP.

3. An error appears: Failed to initialize PEAP or EAP-TLS authentication protocol because CA certificate is not installed. Install the CA certificate using ACS Certification Authority Setup page.

Workaround

Disable the Cisco Security Agent and repeat the installation procedure. Re-enable the Cisco Security Agent.

Possibly worth upgrading?

If so can some one help me with the upgrade stages as im finding them a bit confusing.

Thanks

Kev

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Wed, 13 Feb 2008 15:50:56 GMT

What is the current ver ?

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 15:55:33 GMT

3.3(3) Build 11

Thanks

Kev

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 13 Feb 2008 17:06:15 GMT

Would just like to double check when i select the certificate type in my request i am selecting Web Server ths is correct right as it just needs to be a server SSL cert.

Cheers

Kev

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Thu, 14 Feb 2008 16:11:52 GMT

Thanks for the help.

Re: Replaced Expired Cert on ACS

jlizzio — Wed, 20 Feb 2008 00:22:19 GMT

I have the exact same problem with the exact same build. Did anyone every end up coming up with a solution?

Thanks,

-John

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Wed, 20 Feb 2008 13:52:34 GMT

John,

Make sure you are not hitting Install certificate again after uploading the cert. That was the reason kevin was not able to install it.

If you hit it again, it deletes the installed cert.

Regards,

~JG

Re: Replaced Expired Cert on ACS

jlizzio — Wed, 20 Feb 2008 19:30:44 GMT

Thanks for your post.

I wish it was as easy as me mistakenly removing the certificate after installation.

I'm able to see the certificate installed and I also have CSA disabled. The cert is from our own internal CA so there is no need to add anything to "Edit Certificate Trust List" is there?

Whenever I try and enable "Allow EAP-TLS" i get the following error message.

Failed to initialize PEAP or EAP-TLS authentication protocol because CA certificate is not installed. Install the CA certificate using "ACS Certification Authority Setup" page.

Thanks,

-John

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Wed, 20 Feb 2008 19:52:48 GMT

John,

Have you installed the CA certificate?

If so have you checked it is in the Certificate Trust List?

Cheers

Kev

Re: Replaced Expired Cert on ACS

jlizzio — Wed, 20 Feb 2008 20:09:35 GMT

Yes, the certificate is installed and I have it checked it in the trust list.

-John

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Wed, 20 Feb 2008 20:14:34 GMT

What is the ext of cert you have installed ?

Re: Replaced Expired Cert on ACS

jlizzio — Wed, 20 Feb 2008 20:17:13 GMT

.cer

Re: Replaced Expired Cert on ACS

kevinhobson2000 — Thu, 21 Feb 2008 11:59:05 GMT

Try Base 64 format.

Re: Replaced Expired Cert on ACS

Jagdeep Gambhir — Thu, 21 Feb 2008 13:34:22 GMT

Is RSA key set to 1024 or 2048 ? Use 1024.

Regards,

~JG