topic How to renew a certificate in ISE in Network Access Control

How to renew a certificate in ISE

danilopasiani1 — Wed, 07 Apr 2021 20:22:09 GMT

Hi,

I need help, because we had a supplier that supported ISE, but because of the pandemic, the company ended the contract. So we verified that the CA certificate that validates the corporate wifi has expired and we need to renew it, so I would like to check how I could renew the certificate with the CA server or do I need to create a new certificate?

Re: How to renew a certificate in ISE

Greg Gibbs — Wed, 07 Apr 2021 23:38:19 GMT

It looks like both the identity and root certificates have expired. If that's the case, you'll need to import an updated Root certificate chain (including any intermediate CA certs), generate a CSR, have it signed by the CA, and bind it to the CSR in ISE.

See How To Implement Digital Certificates in ISE for more information.

Re: How to renew a certificate in ISE

Nadia Bbz — Thu, 08 Apr 2021 08:31:46 GMT

Hi ,

to renew system certificate , Administration -> Certificates -> system certificate -> edit the expired certificate -> drop down

in renew self signed certificate -> check renewal period and in Expiration TTL you put the number of year of month as picture below

Re: How to renew a certificate in ISE

Greg Gibbs — Thu, 08 Apr 2021 23:07:14 GMT

This renewal option only works for self-signed certificates. While self-signed certificates may be practical for the Admin or pxGrid functions on small clusters, they are not practical for EAP.

When using private or public signed CA certificates (as per best practice), the entire chain needs to be renewed as described earlier.

Re: How to renew a certificate in ISE

Nadia Bbz — Sun, 11 Apr 2021 14:31:39 GMT

thank your for information

Re: How to renew a certificate in ISE

danilopasiani1 — Wed, 12 May 2021 17:52:20 GMT

Thank you Greg Gibbs. His recommendation helped me.
The certificate is now working.

Re: How to renew a certificate in ISE

anousakisioannis — Mon, 08 Nov 2021 10:35:50 GMT

Hi all,

I am having a similar issue with expired Certificate and the users can't login with their credentials. When they try to connect, they get a generic error "Can't connect to this network". I checked the windows events (attached windows_events_error.PNG) and I got a more specific error : "eap root cause string: windows cannot connect to this network. There is a problem with the certificate on the server required for authentication"

I checked on ISE and indeed there is a certificate, which is signed by CA, is expired.

I would like to ask how can i find if this certificate is used by a policy ?

Also, can i renew somehow the expired certificate, like the self-signed, or i have to create from scratch a new CSR and send it to CA?

Finally, is it necessary to have a signed certificate from a CA or can i have the same functionality with a self-signed certificate ?

Thanks

Re: How to renew a certificate in ISE

anousakisioannis — Thu, 11 Nov 2021 09:04:46 GMT

@Greg Gibbs any advice on this ?