topic Re: ISE as SCEP server in Network Access Control

ISE as SCEP server

umahar — Fri, 16 Jun 2017 18:15:40 GMT

Has anyone implemented ISE as a SCEP server ?

I am trying to enroll a cert into switch to test scep functionality in ISE but I cannot make it work.

ISE SCEP URL

crypto pki trustpoint ISEPSN

enrollment url http://usnjise03.svlab.local:9090/auth/caservice/pkiclient.exe

revocation-check crl

rsakeypair scep

crypto pki authenticate ISEPSN

I am receiving an error after the above switch commands

% Error in receiving Certificate Authority certificate: status = FAIL, cert length = 0

Re: ISE as SCEP server

hslai — Fri, 16 Jun 2017 20:53:50 GMT

ISE internal CA/SCEP is not currently supporting Cisco IOS. See CSCuz49209. There is some mismatch in the cert usage field.

Re: ISE as SCEP server

umahar — Mon, 19 Jun 2017 19:00:29 GMT

Thanks Hsing-Tsu

Will it support another ISE ?

I just want to test the SCEP functionality

I am trying to add one ISE server as SCEP server to another ISE but thats failing too.. Not sure if this would work.

Ultimately we would want to have as SCEP to MDM server.

Re: ISE as SCEP server

hslai — Mon, 19 Jun 2017 19:31:19 GMT

It's tested with ASA only. Here are two LabMinutes video on that:

If you need it supported for external MDM, please bring it up with our PM teams.

Re: ISE as SCEP server

Andreas Jaeger — Wed, 06 Apr 2022 16:37:51 GMT

Is there still no solution to issue certificates to Cisco devices (routers, switches, wlc) from ISE CA?

From my view It is very disappointing that a Cisco CA (ISE) is not able to issue certificates to their own main product series.

Re: ISE as SCEP server

Greg Gibbs — Wed, 06 Apr 2022 22:11:24 GMT

AFAIK this is still not possible. The enhancement 'bug' that was referenced by Hsing below shows a status of Terminated. This is likely because the ISE CA is mainly intended for the BYOD use case (and maybe pxGrid, where needed). It is not intended/supported to be used as an Enterprise CA and that fact is not likely to change.

Re: ISE as SCEP server

Andreas Jaeger — Mon, 11 Apr 2022 12:07:35 GMT

Hi Greg,

I was never asking the ISE to become an Enterprise CA - I was just asking why it does not support Cisco products.

E.g. for RADIUS DTLS with ISE the devices need to have certificates installed, but its own/internal CA is not supporting them.