topic Re: ISE 2.6 - Certificet doesn't update in Network Access Control

ISE 2.6 - Certificet doesn't update

Niklas.D — Thu, 16 Apr 2020 10:26:12 GMT

Hello

So on our Guest Protal we are runing a Cert, and we just updated it.

If you go to Administration -> Certificates -> System Certificets and see it there.

But if you as a guest client access our portal you will see the old Certificet

i have rebooted the servers.

any ides?

Re: ISE 2.6 - Certificet doesn't update

Colby LeMaire — Thu, 16 Apr 2020 15:07:48 GMT

When you added the new certificate, did you assign the proper certificate portal group tag to it? You can also double check your Guest portal configuration to ensure it is still configured to use the correct portal group tag.

Re: ISE 2.6 - Certificet doesn't update

Anurag Sharma — Thu, 16 Apr 2020 18:15:58 GMT

Hi @Niklas.D ,

Can you please double check the tag on the new certificate (as @Colby LeMaire mentioned) ?

Can you please do a Test Portal URL and check which certificate it's showing?

How many nodes do you have and on which patch on 2.6?

Re: ISE 2.6 - Certificet doesn't update

Niklas.D — Wed, 27 May 2020 06:50:43 GMT

Sorry for the late replay as Corona hit the need to drive this case was dimnish, yes i have assaigned the correct tag on it.

Guest Portal, and also the Portal has the same selected.

Re: ISE 2.6 - Certificet doesn't update

Greg Gibbs — Wed, 27 May 2020 22:31:38 GMT

Do you have a load balancer sitting in front of the PSNs? The only time I've seen this same scenario in the past is when a customer had a load balancer that was breaking the SSL and replacing the cert before sending it to the client.

If there's no load balancer, please provide more information about your environment such as number of PSNs, patch level, etc.

Confirm that all PSNs are showing syncronised on the Administration > System > Deployment page.

Did you use the "Portal test URL" option suggested by @Anurag Sharma to confirm which certificate is presented?

Re: ISE 2.6 - Certificet doesn't update

Madura Malwatte — Thu, 28 May 2020 01:19:31 GMT

For the PSN that is presenting the guest portal, if you go to System Certificates page, for this specific PSN does it show the correct certificate and is it assigned the correct tag? Could you have updated the certificate on the admin node, but not on the psn node that is presenting the portal? I would suggest as a test to re-add the certificate again.

Recently, on ISE 2.6 I updated a public wildcard certificate used for guest and admin portals, and it showed all nodes with the new cert, but one of my psn's that had the guest portal was still presenting the old certificate. I can't remember exactly what I did, but it might have been the application restart on this psn was taking a long time due to the same cert being used by the admin portal.

Re: ISE 2.6 - Certificet doesn't update

Niklas.D — Fri, 26 Jun 2020 08:54:41 GMT

There was a Citrix loadbalancer,

and the system hade not syncronised !

thank you for the help!