topic Re: Using ISE CA to sign CSRs in Network Access Control

Using ISE CA to sign CSRs

cat5__utp — Mon, 23 Oct 2017 10:03:34 GMT

I have an ISE deployment that is currently using AD for auth of users. I would like to use certificates to verify the machine identity, one thing that is holding me back is that the deployment has no PKI.

As ISE can function as a CA, is it possible to create CSRs on the endpoints and then use the ISE CA to sign them? These are static endpoints and not BYOD, so once the certs are pushed out there is little ongoing admin.

Re: Using ISE CA to sign CSRs

gbekmezi-DD — Mon, 23 Oct 2017 16:48:55 GMT

Does this help?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/certificate_provisioning/b_certificateprovisioningportalFAQs.html#reference_BCF69D6F74A547AB93079B75B94231A2__Q1

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/200534-ISE-2-0-Certificate-Provisioning-Portal.html

Re: Using ISE CA to sign CSRs

hslai — Mon, 23 Oct 2017 17:10:12 GMT

If CSRs as in certificate signing requests and if they are conforming to the certificate templates in ISE, then ISE may sign them as George already pointed out.

In case CSR as in Cisco Cloud Services Router, then ISE internal CA is not currently supporting to issue certificates for Cisco IOS devices, last I checked. It's because Cisco IOS requiring the certificate with Key-encipherment, digital-signature, or both, and the CA certificates in ISE internal CA chains are not meeting that.

Re: Using ISE CA to sign CSRs

cat5__utp — Fri, 27 Oct 2017 08:27:16 GMT

HI, Thank you so much for your helpful answer, thats cleared it up for me. Certificate signing requests was indeed what I was looking at instead of cloud services routers.