topic Re: Issue Certificate Guest Portal Cisco ISE in Network Access Control

Issue Certificate Guest Portal Cisco ISE

Leonardo Pena Aristizabal — Fri, 21 Feb 2020 18:46:47 GMT

Hello,

I have a Cisco ISE v 2.3 already deploy and working as expected but I have an issue with the guest portal certificate, of course I don't have a public signed certificate on the ISE.

The question is: What kind of certificate do I have to buy, because if I request a SSL Standard I always have to pass the domain control but for this situation this not apply of course the ISE is not a public Web Page.

Thank you very much

Re: Issue Certificate Guest Portal Cisco ISE

Francesco Molino — Tue, 27 Feb 2018 02:18:43 GMT

Any ssl certificates like those are ok:

https://ca.godaddy.com/web-security/ssl-certificate

How many psn do you have? How many portals?

I ask these questions because of you have multiple psn, and you have only 1 certificate you'll need to export (with private key) the certificate and import on all of them. Don't forget to add all san when doing your csr.

Also if you have multiple portals, you can combine all of them into 1 certificate by adding all required san. Or you can plan to get a wildcard certificate and use it for whatever fqdn you want.

Re: Issue Certificate Guest Portal Cisco ISE

Leonardo Pena Aristizabal — Wed, 28 Feb 2018 03:34:10 GMT

But I suspect that this type of certificate need domain validation, I say it because I already try one web server ssl certificate and I can´t validate de web page because it doesn't exist.

Thanks for you time

Re: Issue Certificate Guest Portal Cisco ISE

Francesco Molino — Wed, 28 Feb 2018 05:04:16 GMT

Can you explain the issue you have?

I use these certificates from untrust, GoDaddy, and many other providers and never get issues for ISE portals.

Re: Issue Certificate Guest Portal Cisco ISE

Leonardo Pena Aristizabal — Thu, 01 Mar 2018 03:09:56 GMT

Ok Sorry.

If I buy a Certificate for example from the page you told me, they will validate the domain?

Usually the Public CA require that somehow the stuff they are signing have to be validated throw an e-mail or modifing something in the DNS records.

I don't know if I made myself understood.

This is what I mean:

Thank you very much

Re: Issue Certificate Guest Portal Cisco ISE

Leonardo Pena Aristizabal — Thu, 01 Mar 2018 03:34:39 GMT

Hi,

Look I bought the certificate but this is I what I mean, how do I validate the server if is not public....

Thanks for your time

Re: Issue Certificate Guest Portal Cisco ISE

Francesco Molino — Thu, 01 Mar 2018 04:15:33 GMT

You have 3 types of certificate validation:

EV, OV and DV. DV being the less secure, meant the one on which only verification regarding the domain is done.

They will validate you have the right to use that domain.

I'm not the guy who buys certificate but i deploy them everyday and any vendor out there is working just fine (GoDaddy, Entrust, Thawte...)