topic Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file in Network Access Control

ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Arne Bier — Tue, 20 Oct 2020 11:24:34 GMT

Hello

On a two node ISE 2.7 patch 2 system I saw a strange error while generating a cert in the pxGrid Services screen.

The certificate was in fact generated! - but due to the error message I was unable to download the cert. I don't know any other way to get access to that cert (I can see the cert under the Internal CA Issued Certs)

Short of restarting the ISE node, I don't know what else to try? Anyone seen this before?

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

poongarg — Wed, 21 Oct 2020 04:39:13 GMT

Hello Arne,

If certificate for PxGrid client was generated with CSR in PKCS8 format. If SAN field is configured either in CSR or while generating certificate. If not then try by adding SAN field and check if that resolves the issue.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Andrii Oliinyk — Wed, 21 Oct 2020 06:39:40 GMT

hi Arne

hopefully u have already resolved this issue, but isnt there "Export certicficate" element in "Internal CA issued"?

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Arne Bier — Wed, 21 Oct 2020 06:43:56 GMT

Thanks I already tried that.

The CSR was created on an ISE node.

I was creating two CSRs for the EAP roles on the two PSNs. And the idea was to have the EAP cert signed by the ISE Internal CA, so that I can hand out the ISE Internal Root CA cert to clients. No matter which PSN is used, the client will trust both. This customer has no PKI, therefore it seemed that the ISE CA was ideal.

The first CSR was accepted by the pxGrid certificate generator and it produced a cert that I was able to bind to ISE01. But it's ISE02 that I am having issues with. I created another CSR just for ISE02 but each time I get this .zip error, and the cert is created (but I cannot access it) - all the fields look correct when I view the cert details.

The weird thing is that the cert is always generated correctly and I can see it in the issued Certificates list. It seems like a bug in the packaging of the .zip file. I have never seen such an error and I have created a lot of certs on the internal ISE CA.

I have also stopped and rebooted both nodes - made no difference - still same .zip error.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Arne Bier — Wed, 21 Oct 2020 06:58:51 GMT

@Andrii Oliinyk - sadly not - I can view or revoke the cert. When I view, there are no further options. Not even a BASE64 format that I could copy and paste.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Peter Koltl — Thu, 22 Oct 2020 21:38:43 GMT

Check if the 3-level certificate hierarchy can be traced to a single root CA on both nodes.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZIP file

Arne Bier — Wed, 28 Oct 2020 00:35:48 GMT

wow I hadn't thought of that - I will check - but ISE should not allow more than one Root CA to be in place.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZI

eugeniodesideri — Wed, 11 Aug 2021 14:27:13 GMT

i have the issue , certificate chain was created correctly but the " zip " process keeps fail , and i am not unable to download it .

is there a way to do that with cli?

Re: ISE Internal Cert Generation Failed - Something went wrong with ZI

Greg Gibbs — Wed, 11 Aug 2021 23:08:23 GMT

Certificates cannot be managed via the CLI. If you're having issues generating certificates from the internal CA for supported BYOD/pxGrid use cases, you might try another browser and regenerating the CA Root Chain from the Generate CSR menu.

If you're still having issues, I would suggest opening a TAC case.

Re: ISE Internal Cert Generation Failed - Something went wrong with ZI

hslai — Sat, 14 Aug 2021 04:44:53 GMT

If the ISE admin server certificate is issued by ISE internal CA, then this is a known issue -- CSCvi85028

Or, it could be due to CSCvp30790