topic Re: ISE 2.4 Stuck "Default Portal Cetificate Group" certs in Network Access Control

ISE 2.4 Stuck "Default Portal Cetificate Group" certs

joe_lizzi — Wed, 04 Mar 2020 21:01:14 GMT

I have an interesting issue on one of my ISE 2.4 (Patch 11) nodes. It has somehow managed to get two separate certs assigned to the "Default Portal Certificate Group". For example:

Name: portal-ssl-1.ise Use: Portal Portal group tag: Default Portal Certificate Group

Name: portal-ssl-2.ise Use: Portal Portal group tag: Default Portal Certificate Group

(Note: portal-ssl-2 was imported as a replacement for portal-ssl-1, but instead of switching the tag to the newer cert, it instead seems to have duplicated it.) It won't let me delete either one of them, complaining that they're in use by existing portals. It won't let me edit either one to use a different group tag. I don't have this issue on any of the other nodes in the cluster, all of which had their certs updated.

Is there a way to resolve this, perhaps via CLI?

Re: ISE 2.4 Stuck "Default Portal Cetificate Group" certs

Greg Gibbs — Wed, 04 Mar 2020 21:55:02 GMT

You might try the following:

Export the 'portal-ssl-2' certificate and key to back them up
Create a new self-signed certificate and bind it to the Default Portal Certificate Group
Delete both the 'portal-ssl-1' and 'portal-ssl-2' certificates
Import the 'portal-ssl-2' certificate and key and bind it to the Default Portal Certificate Group
Delete the self-signed certificate

If that still fails, you will need to open a TAC case. Fixing these types of certificate binding issues typically requires TAC using the root patch to delete the certificate bindings directly from the database.

Re: ISE 2.4 Stuck "Default Portal Cetificate Group" certs

joe_lizzi — Thu, 05 Mar 2020 17:53:56 GMT

Okay, looks like it's really stuck in a weird way. It let me assign the self-signed cert to the Portal, but it only took the role away from "portal-ssl-1", leaving "portal-ssl-2" and the self-signed cert assigned to Default Portal duty.

I'll either call TAC or simply reinstall the node. (Probably the latter, since I'm now wary of what else may be messed up on it, and it's currently in a backup role anyway.)

Thank you for the help, Greg.