topic Cisco Ise certificate expired in Network Access Control

Cisco Ise certificate expired

Giesseffe — Thu, 11 Nov 2021 09:00:50 GMT

I have the following three expired certficates on Cisco ISE.

Default self-signed server certificate (expired on 06 Nov 2019)
DST Root CA X3 Certificate Authority (expired on 30 Sep 2021)
VeriSign Class 3 Secure Server CA - G3 (expired on 08 Feb 2020)

Since we have to update to version 2.6 can we prooceed to delete them without any problems?

Alternatively, is it possible to renewal them with a internal ise procedure?

Thanks a lot

Re: Cisco Ise certificate expired

Mark Elsen — Thu, 11 Nov 2021 09:37:51 GMT

- As far as renewal procedures is concerned , you may want to check these documents :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217191-configuration-guide-to-certificate-renew.html

https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Re: Cisco Ise certificate expired

Greg Gibbs — Mon, 15 Nov 2021 21:51:44 GMT

See the following posts related to the public signed certs:

OK to delete DST Root CA X3 Certificate Authority ?

[ISE 2.3.7] How to renew the 'VeriSign Class 2 Secure Server CA - G3 in Trusted Certificates.

If the self-signed cert does not have a usage attached, you can delete it. If it does have a usage attached (e.g. SAML, pxGrid, etc), you should generate a new self-signed certificate for that usage, then delete the expired cert.