topic Re: ISE OCSP Responder Certificate expiring in Network Access Control

ISE OCSP Responder Certificate expiring

colossus1611 — Fri, 02 Jul 2021 02:57:07 GMT

Hello,

We have a couple of OCSP responder certificates expiring after 60 days. When I check the 'Issued by' column it has the name of one of the other node on it, which is the PAN.

However, I am at a loss about how do I go further to renew it. There seems to be no basic documentation to cover this, but I am sure it is quite simple.

How do I go about renewing it?

Friendly Name Status Trusted For Issued To Issued By Valid From Expiration Date
Certificate Services OCSP Responder - ISE01#00016 Enabled Endpoints,Infrastructure Certificate Services OCSP Responder - ISE01 Certificate Services Root CA - ISE02 Sun, 25 Sep 2016 Sun, 26 Sep 2021
Certificate Services Endpoint Sub CA - ISE01#00017 Enabled Infrastructure,Endpoints Certificate Services Endpoint Sub CA - ISE01 Certificate Services Root CA - ISE02 Sun, 25 Sep 2016 Sun, 26 Sep 2021

Re: ISE OCSP Responder Certificate expiring

Arne Bier — Sun, 04 Jul 2021 21:53:45 GMT

Hi @colossus1611

It's kind of hidden

Re: ISE OCSP Responder Certificate expiring

colossus1611 — Thu, 15 Jul 2021 01:38:50 GMT

Hi @Arne Bier ,

Thank you! I didn't notice your response and was wondering how to go about this. So basically this will renew it same as self-signed certificates it seems.

I will give it a go sometime today. Correct me if I am wrong but I think business hours should be fine as it shouldn't cause any disruption by the look of it.

Re: ISE OCSP Responder Certificate expiring

Arne Bier — Thu, 15 Jul 2021 04:02:27 GMT

It won't cause any outage - the cert's private key is retained, and all that happens is that the new cert has a new start and end date and a new signature (hash). Serial number should also remain as is, as far as I know.

**Correction: The Serial number is different - this implies that the certificate is actually regenerated. But it's pretty quick - should be done in less than a minute.

Re: ISE OCSP Responder Certificate expiring

colossus1611 — Thu, 15 Jul 2021 03:56:51 GMT

Hi @Arne Bier ,

Thanks again. I did go through the renewal process which seems to be just a single click with no selection of nodes required. It's been about an hour now and the certificates are still displaying an old expiry date, though it did suggest it may take some time at time of renewal.

Interesting that it did not ask for a node name at all and yet all the nodes currently have a different OCSP expiry date.

I might have to do this again - don't think the renewal will kick in now, given that it has already been more than an hour of wait.

Re: ISE OCSP Responder Certificate expiring

ivan_abibe — Tue, 21 Feb 2023 13:29:54 GMT

Did they eventually renew? I also did the same and it's been a while not sure how long we are supposed to wait

Re: ISE OCSP Responder Certificate expiring

Danny Dulin — Thu, 16 Oct 2025 10:49:25 GMT

Did this work for any of you?

Re: ISE OCSP Responder Certificate expiring

Danny Dulin — Thu, 06 Nov 2025 14:42:16 GMT

@Arne Bier I have done this several times and it has not worked.

The OSCP responder certificate that has expired is in Admin>Certificates>Certificate Authority>Certificate Authority Certificates.

Does this matter?

Re: ISE OCSP Responder Certificate expiring

Arne Bier — Thu, 06 Nov 2025 20:18:36 GMT

It can take a little while to display the new OCSP cert - and also, you might not see it immediately, because ISE doesn't delete the old one - keep scrolling to the end and keep an eye on the "#" number - in the past, I have had to manually delete the expired certs in the correct order (reverse order of creation - so, OCSPs first, then Endpoint Sub CAs, then Node CAs and lastly, the Root (there is only one))

Re: ISE OCSP Responder Certificate expiring

MichaelMcCoyOU — Tue, 07 Apr 2026 20:45:13 GMT

Bumping for the same reason. I went through this process a few weeks ago, and I still have the expired certs showing.

Re: ISE OCSP Responder Certificate expiring

Danny Dulin — Tue, 07 Apr 2026 21:13:18 GMT

I eventually opened a TAC case and they were able to help me to get it deleted.