topic Re: ISE Certificate stale status in Network Access Control

ISE Certificate stale status

Anilvnair — Wed, 20 Jul 2022 12:05:06 GMT

Hello Members,

I see after the certificate binding on ISE, the cert status as Stale, under the system certificate tab. How to fix this issue?

Re: ISE Certificate stale status

ahollifield — Wed, 20 Jul 2022 14:44:12 GMT

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_basic_setup.html#concept_a1f_v2t_msb

Re: ISE Certificate stale status

ahollifield — Wed, 20 Jul 2022 14:44:28 GMT

Stale System and Trusted Certificates

Stale certificates are certificates that don’t belong to any node in the deployment. These redundant certificates might accumulate in large numbers in the System and Trusted Certificate stores, leading to insufficient memory and latency issues. From with Cisco ISE Release 3.1, such redundant certificates carry a Stale Certificate status, enabling you to review and delete them.

Re: ISE Certificate stale status

thomas — Wed, 20 Jul 2022 14:59:26 GMT

Did you search for the word "stale" in the ISE Admin Guide?

ISE 3.1 Administrator Guide > Basic Setup

Re: ISE Certificate stale status

ffischer — Wed, 10 Jan 2024 12:36:08 GMT

In a complex deployment runnin for years now we are using seperate interfaces for the Guest Portal.
We have a Guest Portal Certificate signed by 3rd party that ist shown as stale,
because neither its' CNs nor its SANs match the fqdn of the one of the nodes.
We use "ip host" aliases for guest portal setup that ISE cert check obvoiusly forgot to consider
if an installed system certificate is referenced.

And.... Yes, I have read the manuals ... at least partially 😉

Re: ISE Certificate stale status

Gioacchino — Sun, 25 Feb 2024 15:55:15 GMT

Hi @ffischer ,

we ran into this issue as well. Does the "ip host" fix definitely the issue?

Thx, Gio

Re: ISE Certificate stale status

ffischer — Thu, 29 Feb 2024 14:47:46 GMT

Well..
The certificates are cecked for beeing referenced in the ISE config
by internal code running automatically in regular intervals.
The code obviously ignores the host names in the ip aliases on the CLI.

I'm not aware of a confirmed bug nor a fix for this bug.

Nothing you or I can "fix" if you need the host alias.
If you do not need it, then delete it.