topic Re: PXGrid Certificate in Network Access Control

PXGrid Certificate

Richard Lucht — Tue, 19 Nov 2019 20:52:22 GMT

I am trying to create PXGrid certificates with Cisco ISE and I am getting an error.

Certificate generation failed: Not able to build the ISE CA chain to the root. Chain size: 2: INTERNAL_SERVER_ERROR

Can someone help me with this?

Re: PXGrid Certificate

jj27 — Tue, 19 Nov 2019 21:29:26 GMT

What version and patch is installed?

Re: PXGrid Certificate

Richard Lucht — Tue, 19 Nov 2019 22:05:55 GMT

Version 2.4.0.357 patch 6

Re: PXGrid Certificate

Anurag Sharma — Wed, 20 Nov 2019 09:50:22 GMT

Hi @Richard Lucht ,

Can you please try to rebuild the internal CA on the ISE and see if this resolves the issue?
Regenerate Internal CA of the ISE: Administration > System > Certificates > Certificate Signing Request > Generate CSR > ISE Root CA

Re: PXGrid Certificate

Might Ncube — Sun, 18 Jun 2023 02:18:10 GMT

After weeks of struggling with this issue.

I ended up generating a new Root CA and DNAc could join successfully. At some point I blamed a bug. Running ISE 3.1 and DNA Version 2.2.3.6.

I could have broken the certchains on ISE when doing an upgrade and when I recovered admin password.

Checked my radius clients,, they were not affected by regeneration of new Root CA.