topic Re: Renew "Certificate Services Node CA" Certificate over in in Network Access Control

Renew "Certificate Services Node CA" Certificate over internal CA

marcelma — Mon, 12 Jul 2021 13:25:08 GMT

I'm looking for a way to renew the "Certificate Services Node CA" certificate that was signed by the internal Root CA.

The Node CA is expired but was not renewed by ise. I'm able to create a csr but can't find a way to sign it, except exporting and sign it with an external CA.

Any help would be appreciated.

Re: Renew "Certificate Services Node CA" Certificate over internal CA

Greg Gibbs — Tue, 13 Jul 2021 00:57:44 GMT

If the Node CA certificate is expired, it's likely the entire Root chain has also expired. You can generate a new Root CA chain from the Administration > System > Certificates > Certificate Management > Certificate Signing Requests > Generate Certificate Signing Requests (CSR) page by selecting the ISE Root CA usage.

Re: Renew "Certificate Services Node CA" Certificate over internal CA

marcelma — Tue, 13 Jul 2021 09:29:43 GMT

Thanks, this is working.

My Root CA is still valid for a few jears but as I'm unable to sign thenode CA csr the Root CA renewal is a good workaround as ise created every Sub-CA new. I can now just remove the old certificates.

Re: Renew "Certificate Services Node CA" Certificate over in

marinogr — Fri, 05 Jan 2024 08:02:38 GMT

This is working solution, thanks.

You need to "Enable Certificate Authority" if it is disabled.

Administration > System > Certificates > Certificate Authority > Internal CA Settings > Enable Certificate Authority