topic Re: Error message when binding the certicate from a third CA in Network Access Control

Error message when binding the certicate from a third CA

cdmadmin — Wed, 27 Oct 2021 15:46:06 GMT

Hello,

My first Sectigo RSA Domain Validation Secure Server CA-use certicate wa expired since 7 Aug 2021(System Certificate) and I've generate a self signed certicate. 2 days ago I've requested from a new certicate from the third CA using the existing CSR. I've received from them the certificate and the bundle as well (but note that my SECTIGO_Intermediate and Root are not expired yet, the expirations dates are Dec 2030 and Jan 2038).

After binding the certificate, I get the message below.

It's for Cisco ISE.

Please, can you assist me

Re: Error message when binding the certicate from a third CA

Greg Gibbs — Wed, 27 Oct 2021 21:52:39 GMT

As the error states, ISE will not allow creating a CSR or binding a certificate that has the same Subject as another certificate. A common approach is to modify one of the certificate fields so that there is no matching Subject value.

I typically use the OU field in the certificate to indicate the Usage (Admin, EAP, etc) of the certificate to avoid duplicate Subject value issues. When renewing a certificate, I often just modify the same OU field slightly (like adding the Month/Year) to produce a unique Subject value.

I haven't seen anyone using the OU attribute as a matching condition in policies, so it is often easy to change.

Re: Error message when binding the certicate from a third CA

cdmadmin — Thu, 28 Oct 2021 13:35:57 GMT

Hello Greg,

Thanks for your reply and note that I did the change on the subject ("OU" and "O") three times and get the same message.

One precision, actually I have the "Self Signed Certificate" and I want to replace it by the one signed by CA.

It's not a renew

Regards

Re: Error message when binding the certicate from a third CA

cdmadmin — Tue, 09 Nov 2021 16:02:39 GMT

Hello,

I've solved my problem. While binding the CA certificate, I did not select any usage and after certificate installation, I just edit it by selecting the usage needed.