topic Re: Remove endpoint certificate from ISE internal CA in Network Access Control

Remove endpoint certificate from ISE internal CA

Eric Pineda — Thu, 08 Sep 2016 00:13:13 GMT

Hi folks,

Is it posible to remove endpoint certificates generated by ISE internal CA?

Thanks,

Eric

Re: Remove endpoint certificate from ISE internal CA

Charlie Moreton — Thu, 08 Sep 2016 13:45:39 GMT

Yes, you can revoke an endpoint cert by going to Administration > System > Certificates, choose Endpoint Certificates from the Left Menu. Select the cert you would like to revoke and click the X Revoke button.

Screenshot is from ISE 2.1

Re: Remove endpoint certificate from ISE internal CA

Jason Kunst — Thu, 08 Sep 2016 13:48:28 GMT

You can revoke but not remove (delete)

Re: Remove endpoint certificate from ISE internal CA

howon — Thu, 08 Sep 2016 14:34:55 GMT

Endpoint certificates will be removed 30 days after its expiry automatically. Revoked certificates will also be removed 30 days after expiry.

Re: Remove endpoint certificate from ISE internal CA

Eric Pineda — Thu, 08 Sep 2016 17:48:09 GMT

Thanks for the responses!

Re: Remove endpoint certificate from ISE internal CA

Looi Siew Key — Fri, 07 Dec 2018 08:18:10 GMT

Hi howon,

How if the expired or revoke certificate to be retained or extend listed in endpoint certificate before automatically delete ?

Re: Remove endpoint certificate from ISE internal CA

salprevitera — Wed, 03 Aug 2022 16:57:48 GMT

so, what you saying if the certificate expire in 2 years, it will stay there for 2 years and 30 days before it is gone....WOW

Re: Remove endpoint certificate from ISE internal CA

saxenanitesh8522 — Wed, 02 Nov 2022 12:11:02 GMT

If we are revoking the certificate the users are stil able to login.

We have gone to the internal ca and revoked the certificate but the device is still authenticating and getting on-board.

Re: Remove endpoint certificate from ISE internal CA

Greg Gibbs — Wed, 02 Nov 2022 21:34:15 GMT

It sounds like ISE is not performing the revocation checks for some reason. I would suggest confirming the following:

Verify that the internal CA/EST/OCSP responder is enabled in Admin > System > Certificates > Certificate Authority > Internal CA Settings
Verify that the OCSP validation is enabled and using the internal OCSP responder for all of the internal CA chain certificates in Admin > System > Certificates > Certificate Management > Trusted Certificates

If both of those are verified, you likely need to open a TAC case to investigate further.