topic Re: ISE certificate issue in Network Access Control

ISE certificate issue

atheio — Wed, 15 Jun 2022 15:31:56 GMT

I am having a problem binding a CSR and the resulting certificate. I get the error "Certificate must contain the FQDN...". Research has shown that this has occurred before and was related to a SAN not matching the domain. I have verified that they do match, no leading or trailing spaces; no 0o/1l typos. My cert looks like:

(The machine name is ise01)

-Multi-use

Allow Wildcard Certificates

CN: ise.client.com

SAN: ise.client.com

*.client.com

ise01.client.com

I checked the hostname in CLI and even made sure the virtual machine name was all matching. Does anyone know what log would contain failures for this? I tried recursive grep'ing for different words from the support bundle and could not find anything. What else would you recommend. Thank you for your time.

Re: ISE certificate issue

ahollifield — Wed, 15 Jun 2022 15:39:19 GMT

Is the FQDN of ISE actually ise01.client.com? Or is it something else?

Re: ISE certificate issue

atheio — Wed, 15 Jun 2022 15:46:44 GMT

Yes it is.

Re: ISE certificate issue

balaji.bandi — Wed, 15 Jun 2022 17:32:01 GMT

ise01.client.com - is this resolving in your nslookup ?

Re: ISE certificate issue

atheio — Wed, 15 Jun 2022 18:13:17 GMT

No it doesn't sir. This ISE server will be primary (10.1.1.134) and a secondary. (10.1.1.135). I wasn't sure if I needed to make the "ISE-cube" first or apply certificates. I have only created A-records pointing ise.client.com to those IPs.

Re: ISE certificate issue

balaji.bandi — Thu, 16 Jun 2022 06:56:25 GMT

create another A entry for ISE01 and test it.

Re: ISE certificate issue

atheio — Thu, 16 Jun 2022 13:04:23 GMT

Ok, I added an A record for ISE01, generated the CSR and I get the same error when I try to bind the new cert to the csr. Should I add the machine hostname to the SAN field?

ex: ise.client.com

*.client.com

ise01.client.com

Re: ISE certificate issue

ahollifield — Thu, 16 Jun 2022 14:47:24 GMT

Machine hostname? I thought the ISE hostname was ise01.client.com? Is the DNS ise01.client.com but the actual hostname of the ISE node something else?

Re: ISE certificate issue

atheio — Thu, 16 Jun 2022 16:35:18 GMT

Sorry, I think I am muddying the water. Here is a diagram of the setup. Do I need to add ise01.client.com and ise02.client.com to the SAN fields?

Re: ISE certificate issue

ahollifield — Thu, 16 Jun 2022 16:27:59 GMT

Yes, the FQDN/hostname of the individual ISE Server (or a wildcard) must be in the SAN field.

FYI, your screenshot includes the actual DNS name of the ISE node. You may want to blank that out for privacy.

Re: ISE certificate issue

atheio — Fri, 17 Jun 2022 13:51:04 GMT

I identified the issue. The wrong cert was purchased. We ordered a basic, when we needed a wildcard, that was why "www." was getting auto-populated in the SAN field. Thank you all for your help!