topic Re: Self-signed Root certificates in Network Access Control

Self-signed Root certificates

fazmeister4 — Tue, 10 Dec 2019 14:05:46 GMT

My self signed Root certificates have expired in the Trusted certificates section. They are not being used by any services yet I'd like to renew them. Unlike the System certs there is no option to renew them. Anyone assist ?

Re: Self-signed Root certificates

Arne Bier — Thu, 12 Dec 2019 04:33:54 GMT

You should not put self signed certs in the Trusted Store. The Trust Store is for CA certs. Yes - self-signed certs are Root certs and therefore a CA 🙂 But - you said you don't use ISE self-signed certs. So why do you want to keep these hanging around?

So to answer your question - an ISE Self-Signed cert originates from the System Certs section. go there and click on the Generate Self-Signed cert to create new ones. Then delete the old one(s).

Re: Self-signed Root certificates

Jason Kunst — Thu, 12 Dec 2019 17:13:10 GMT

@Arne Bier wrote:

You should not put self signed certs in the Trusted Store. The Trust Store is for CA certs. Yes - self-signed certs are Root certs and therefore a CA 🙂 But - you said you don't use ISE self-signed certs. So why do you want to keep these hanging around?

So to answer your question - an ISE Self-Signed cert originates from the System Certs section. go there and click on the Generate Self-Signed cert to create new ones. Then delete the old one(s).

agree, also check out https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Re: Self-signed Root certificates

fazmeister4 — Tue, 17 Dec 2019 10:13:15 GMT

Thanks, I've removed them now