topic Re: Problems Using Self-Signed Certificates to Register Node in Network Access Control

Problems Using Self-Signed Certificates to Register Node

s1nsp4wn — Mon, 22 Jul 2019 23:04:59 GMT

I'm trying to register a 2nd node into my ISE 2.4 deployment. I get warned that the default self-signed device cert of the other ISE node is being offered and I click accept to trust it anyways. I get the error

Unable to authenticate ISE <2nd-ISE-FQDN>. Please check certificate configuration.

Make sure from ‘Primary Admin node’, system certificate chain of registering node is present in ‘Trusted certificates’ and is enabled with ‘Trust for authentication within ISE’ option selected.

Well I exported that cert from the I want to register into the PAN i'm registering from to trusted store and selected use with ISE option as asked and I'm still greeted with that error. Is this no the recommended way? I'm using the suggestions from Cisco's admin guides and lab minutes youtube videos.

Re: Problems Using Self-Signed Certificates to Register Node

hslai — Mon, 22 Jul 2019 23:25:59 GMT

The message is the same as reported in CSCvd33544

If possible, please open a TAC case, as our teams have not found a way to recreate it. And, one deployment had mismatched domain-name between what configured ISE admin CLI and shown in ISE admin web UI.

Re: Problems Using Self-Signed Certificates to Register Node

s1nsp4wn — Tue, 23 Jul 2019 13:14:45 GMT

Figured this out based on some of the description there. The domain name I used during install locked in the self-signed cert so when I had to change the domain name because I later found out it was incorrect, this caused me problems. I changed the domain name from the ISE command line, waited a few for new certs to generate, and imported those successfully and registered what I needed. Thanks!