topic ISE 2.1 self signed certificates - Renew in Network Access Control

ISE 2.1 self signed certificates - Renew

sadowski271 — Mon, 25 Feb 2019 11:01:20 GMT

hi all!

I do not find anything in any manulas regarding certificate on ISE server and renew option in self-signed cert(only import the new one is described). Currently I do not use any internal or external CA. current self-signed cert will be not valid in few weeks and I would like to extend it for next year. When I did a change and put in renew field 1 year - I see that inside system certifcates the valid date is changed and the same after export and import that new one to Trusted certicates store on ISE Server. but when I log in i see that in browser old certificates still exist. Is it neccessary to restart the ISE application ?

I have a distributed deployment 2xAdmin 2 x monitor 2x PSN

thx for help !!

Re: ISE 2.1 self signed certificates - Renew

Rob Ingram — Mon, 25 Feb 2019 12:59:09 GMT

Hi,
When replacing the Admin certificate the ISE application server service would inform you that service will be restarted, it does this itself when you click Yes/Ok. If you navigate to Administration > Certificates > System Certificates does it confirm the new certificate is "Used By" "Admin"? If not then the new certificate has not been bound to that role.

If the new certificate is "Used By" "Admin" then potentially the browser just needs refreshing.

HTH

Re: ISE 2.1 self signed certificates - Renew

sadowski271 — Mon, 25 Feb 2019 13:08:05 GMT

it is used by Admin role. What i have done is use the renewal option for self-signed certificate. After clicking "save" ISE didn't restart but Expiration date for certificates used for Admin role has changed

Re: ISE 2.1 self signed certificates - Renew

NaujEl — Mon, 03 Jun 2024 04:24:57 GMT

Hi,

Apologies for the delay. Did this option work for you?

Re: ISE 2.1 self signed certificates - Renew

ahollifield — Mon, 03 Jun 2024 12:26:07 GMT

This is a very old post from a long EOL version of Cisco ISE. I would highly suggest starting a new post for your issue. https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-741732.html