topic ISE nodes with expired admin certificate in Network Access Control

ISE nodes with expired admin certificate

rfountain72 — Wed, 06 Jul 2022 00:34:26 GMT

I have an ISE environment that we use for Tacacs, we are running version 2.6. The issue that I have is that for whatever reason, someone renewed the production TLS certificate on the primary admin node but didn't update the other nodes. So now when I go into the certificate store area and try to select any of the other two nodes [with expired 3rd party certificate] I get the error you see attached.

Can someone show me the article that would show someone how to renew certificates on a node that is giving this error? Thanks!

Re: ISE nodes with expired admin certificate

ahollifield — Wed, 06 Jul 2022 00:45:59 GMT

You should be able to HTTPS directly to the other nodes. On the admin GUI, you can perform certificate operations on the individual nodes.

Also: https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2503911.html

Re: ISE nodes with expired admin certificate

rfountain72 — Wed, 06 Jul 2022 01:00:35 GMT

Thank you, I'm a bit closer as I'm logged into that node directly but the only choice I have is to "export" certificates. I don't see where I can import the certificate that I exported from the primary PAN. I logged onto the other node as well and same thing, just "export". Does this need to be done via CLI? I'm logging in with the local admin account to make sure I have all rights.

Re: ISE nodes with expired admin certificate

ahollifield — Wed, 06 Jul 2022 01:52:38 GMT

Yeah I misunderstood the original question, for the secondary nodes I’ve always just rebuilt from scratch when I run into this at customer sites. See this thread: https://community.cisco.com/t5/network-access-control/ise-expired-certificate-on-de-auth-node/td-p/4442884

Re: ISE nodes with expired admin certificate

Arne Bier — Wed, 06 Jul 2022 21:10:18 GMT

Or if it's possible to de-register the nodes ? Once they are in Standalone you can manage them directly. But if the de-registration doesn't work then a rebuild is needed