topic ISE certificate store update after CA lifetime extension in Network Access Control

ISE certificate store update after CA lifetime extension

Thomas Thiele — Mon, 17 Dec 2018 09:54:45 GMT

HI all,

after extending the sub-ca (which issued the ISE admin + eap certs) by using same private key (just extended the expire date), we are faced with updating the ISE certificate trust store..but this seems to be impossible without major impact:

adding the "new" sub-ca cert is not allowed in ISE
removing the old sub-ca cert is also not allowed because ISE certs are issued by this ca

Our "solution":

delete all ISE ca certs (ouch!)
delete old sub-ca
add new-sub ca
get new ISE eap + admin cert

We are looking for a better way to get this done..

Re: ISE certificate store update after CA lifetime extension

hslai — Mon, 17 Dec 2018 15:12:10 GMT

This is likely a current limitation, as recent ISE releases have an issue to deal with any certificates with the same subjects in the ISE certificate stores.

IIRC it able to replace the certificate(s) OK if using a new private key.

Re: ISE certificate store update after CA lifetime extension

Thomas Thiele — Mon, 17 Dec 2018 15:18:53 GMT

OK, but this is no option at the moment. Extending CA certificate by using same private key is a standard operation afaik.