topic Re: CISCO ISE 2.4 Alarm about expiration certificate (SAML) in Network Access Control

CISCO ISE 2.4 Alarm about expiration certificate (SAML)

Nadia Bbz — Thu, 23 Jan 2020 12:17:42 GMT

Hey Dear ;

Trust certificate 'Default self-signed server certificate' will expire soon

we would like to know what does mean usage for SAML, and to know if this certificate is really used in my case and how to renew it.

Alarm Name :

Certificate Expiration

Details :

Trust certificate 'Default self-signed server certificate' will expire in 60 days : Server=SRP-01-CISE010

Description :

This certificate will expire soon. When it expires, ISE may fail when attempting to establish secure communications with clients. Inter-node communication may also be affected

Severity :

Warning

Suggested Actions :

Replace the certificate. For a trust certificate, contact the issuing Certificate Authority (CA). For a CA-signed local certificate, generate a CSR and have the CA create a new certificate. For a self-signed local certificate, use ISE to extend the expiration date. You can just delete the certificate if it is no longer used

Thanks for help

Re: CISCO ISE 2.4 Alarm about expiration certificate (SAML)

Arne Bier — Thu, 23 Jan 2020 21:28:35 GMT

Hi @Nadia Bbz

I implement my own best practice for these situations: any cert that is not required on my customers' nodes is given a 10 year self-signed cert, to ensure that they don't get any expiration notices for certs they don't need. 10 years is the max - but by then I would assume the system would have been rebuilt anyway.

Under System Certs, generate a new self-signed cert to replace the current cert. Let's say you want to replace the SAML cert.

Re: CISCO ISE 2.4 Alarm about expiration certificate (SAML)

Nadia Bbz — Sun, 26 Jan 2020 09:16:16 GMT

Hey @Arne Bier ,

Thanks so much for helping me , I greatly appreciate it.

it's possible to renew certificate just to check the box renewal period and put 10 years or 5 years like the picture below

i have another certificate that will expired soon, should i apply the same method to solve it

thanks for help

Re: CISCO ISE 2.4 Alarm about expiration certificate (SAML)

Arne Bier — Mon, 27 Jan 2020 21:45:13 GMT

Hello @Nadia Bbz

I learned something new! Thank you. I have never used that renew self cert button button. It does exactly what it says. For self-signed certs it seems you can either create a new one and delete the old one, or simply use the renew feature.

Here's the difference between creating a new cert, and renewing a cert:

Create New Cert: creates a new Cert Serial Number - calculate new cert Fingerprint (hash)
Renew Cert: Maintain same Serial Number and update the Validity period - calculate new cert Fingerprint (hash)

regards

Arne

Re: CISCO ISE 2.4 Alarm about expiration certificate (SAML)

r1127hyduk — Wed, 02 Sep 2020 11:59:46 GMT

Good notes here - thanks for posting. Potential issue avoided!