topic Re: ISE sends the old self-signed certificate instead of the newly one in Network Access Control

ISE sends the old self-signed certificate instead of the newly one

rezaalikhani — Thu, 11 May 2023 03:50:15 GMT

Hi all;

Look at the following figure:

As you can see, I replaced the ISE self-signed certificate with my domain-based certificate. But, when I want to connect ISE with a domain joined computer (so, the root CA certificate that ISE uses, also has been installed on that system), ISE advertises its previous self-signed cert:

I am using ISE 3.2 Patch 1 in my lab...

Any ideas?

Re: ISE sends the old self-signed certificate instead of the newly one

balaji.bandi — Thu, 11 May 2023 08:40:32 GMT

i have not come across any issue before, try remove and re-installing again and test it.

On the end device try delete any old root certs were associated for the old one ?

Note : other option before re-installing - Close the browser - clear the cache and reboot the PC and test it.

Re: ISE sends the old self-signed certificate instead of the newly one

Nancy Saini — Thu, 11 May 2023 13:25:13 GMT

The node on which the certificate is installed is the one handling the authentication request, right? If yes then maybe the change didn't get reflected at the DB level. Can you try reloading the node and check?

Re: ISE sends the old self-signed certificate instead of the newly one

rezaalikhani — Fri, 12 May 2023 04:17:00 GMT

Thanks for your reply;

As you can see in my post, this is not the browser issue, as ISE is advertising its previously self-signed certificate, instead of the newly added certificate.

Re: ISE sends the old self-signed certificate instead of the newly one

Dustin Anderson — Fri, 12 May 2023 16:26:10 GMT

I would also try an incognito browser as I have seen the browser not reflect the change even though the cert has changed.

Re: ISE sends the old self-signed certificate instead of the newly one

rezaalikhani — Sun, 14 May 2023 07:40:05 GMT

This is my exact problem...

Re: ISE sends the old self-signed certificate instead of the newly one

rezaalikhani — Sun, 14 May 2023 07:40:58 GMT

I have reloaded the server several times but the issue persists...

Re: ISE sends the old self-signed certificate instead of the newly one

rezaalikhani — Thu, 18 May 2023 03:08:35 GMT

Removing the old cert and re-installing it, solved the issue...