topic After upgrade to 2.6 CA process not starting in Network Access Control

After upgrade to 2.6 CA process not starting

ksastoqu — Thu, 01 Aug 2019 14:13:39 GMT

After upgrading to v2.6 on primary node, Certificate Authority Service is running well. While on secondary node, Certificate Authority Service cannot initiate.

In v2.4, Certificate Authority Service was running well on both nodes.

ISE PROCESS NAME                       STATE            PROCESS ID
--------------------------------------------------------------------
Database Listener                      running          2608
Database Server                        running          119 PROCESSES
Application Server                     running          11194
Profiler Database                      running          5251
ISE Indexing Engine                    running          13422
AD Connector                           running          19174
M&T Session Database                   running          5013
M&T Log Processor                      running          11417
Certificate Authority Service          initializing
EST Service                            not running
SXP Engine Service                     disabled
Docker Daemon                          running          6395
TC-NAC Service                         disabled

We have tried restarting the application many times (stop/start), but same result.

We tried this

 https://community.cisco.com/t5/identity-services-engine-ise/error-message-quot-est-service-not-running-quot-since-upgrade-to/td-p/3484698

But customer does not have Plus License to generate CSR. (EST service is also not running).

Re: After upgrade to 2.6 CA process not starting

hslai — Tue, 06 Aug 2019 17:32:26 GMT

Please try recreating and engaging our ISE ESC team, if needed. CSCvj11319 is not a known issue for ISE 2.6.

ISE Plus licenses are not required to run ISE CA services, as to support session exchanges via pxGrid for Cisco subscribers.

Re: After upgrade to 2.6 CA process not starting

dave.devries — Fri, 20 Dec 2019 17:54:22 GMT

Actually, Plus license is required for internal CA between two ISE nodes. Unfortunately, that does not solve this problem.

Re: After upgrade to 2.6 CA process not starting

mattvoon91 — Thu, 26 Mar 2020 10:27:21 GMT

So regenerating the ISE root cert will solve the issue?

Will regenereating the cert impact the registration of the 2 ISE node?