topic Re: ISE: how to extend the due of certification in Network Access Control

ISE: how to extend the due of certification

naoki_Japan — Tue, 12 Oct 2021 12:20:18 GMT

I found that there are 4 self-signed certifications on the ISE by default.

One of them is for SAML, only which of the due can be extended by checking the " Renewal Period" box and enter the TTL.

However, as for the other certifications, I can not check the box and not extend the due.

moreover, for certification of ISE Messaging service, I notice that I cannot create it on the panel >Generate Self Signed Certificate

please tell me how can I handle this problem.

should I create new certification ?

how can I extend the due of certification of ISE Messaging service and others?

Re: ISE: how to extend the due of certification

ComputerRick — Tue, 12 Oct 2021 13:45:44 GMT

For the ISE Messaging Service, it is generated from the Internal CA service that runs on ISE.

The Messaging cert is not extended, and for this case, I would suggest regenerating the ISE Root CA.

Go to Certificates, then Certificate Signing Requests, and Generate CSR. There will be a pull-down menu, select ISE Root CA from that and then the Generate button. The pull-down will also have the ISE Messaging cert, among others. If your messaging cert is about to expire, it's likely expiring on more than one node and a new root would be a better method.

HTH.

Re: ISE: how to extend the due of certification

Marvin Rhoads — Tue, 12 Oct 2021 16:02:27 GMT

In addition to what @ComputerRick correctly noted, you must first have the Internal Certificate Authority (CA) enabled for the ISE Root CA option to be available as an option.

Administration > System > Certificates > Certificate Authority > Internal CA settings > Enable Certificate Authority

Re: ISE: how to extend the due of certification

naoki_Japan — Thu, 14 Oct 2021 00:40:36 GMT

As you advised, I set up internal CA and got it!!!

thank you for support!! appreciate it!!

Re: ISE: how to extend the due of certification

naoki_Japan — Thu, 14 Oct 2021 00:43:09 GMT

Your advice solved the problem I had.
THX!!!