topic Re: unable to change "usage" of a certificate in Network Access Control

unable to change "usage" of a certificate

fabioairoldi — Mon, 29 Jan 2024 11:12:00 GMT

Hello all,

I imported a third-party signed certificate to be used as a Guest Portal certificate in my cisco ISE 3.2.

The trust chain is correctly imported under "Trusted Certificates". However in Aministration/System/Certificates/Certificate Management/System Certificates, when I go to edit the newly imported certificate, i see the boxes for possible usage (Portal, ISE Messaging Server, SAML, etc...) greyed out and I am unable to interact.

I might add that the same certificate has been imported successfully and is in use on a variety of different appliances, so I don't think there's a an issue with the cert itself.

Any one can suggest some troubleshooting steps?

Thanks

Re: unable to change "usage" of a certificate

Aref Alsouqi — Mon, 29 Jan 2024 11:25:18 GMT

Did you generate the CSR from ISE? if so, what usage did you select when you generated it? if not, what usage did you select when you imported the certificate first time?

Re: unable to change "usage" of a certificate

fabioairoldi — Mon, 29 Jan 2024 11:37:44 GMT

the certificate was generated by an external authority and consequently imported. I will refer to this as the "real" cert.

I selected "ISE Messaging Services" and "Portal" for usage at the time of upload.

Then to troubleshoot a different issue I edited the default self-signed certificate usage, using it for "Portal" (in this way I removed the "Portal" usage from the real cert I wanted to use).

Now I find myself unable to revert back to using the real cert for Usage --> Portal.

Hope this answers

thanks

Re: unable to change "usage" of a certificate

Aref Alsouqi — Mon, 29 Jan 2024 12:33:57 GMT

It did, thanks. What usage do you currently see on the real cert?

Re: unable to change "usage" of a certificate

fabioairoldi — Mon, 29 Jan 2024 13:33:05 GMT

Just the ISE Messaging Service (which incidentally is not in use yet so it can be modified with no issues).

If I hover over any of the checkboxes I see the cursor turn into a "forbidden" sign and am unable to click.

I already tried restarting the ISE service and changing browser, fearing it could be just a GUI bug. It seems not to be the case.

Re: unable to change "usage" of a certificate

Aref Alsouqi — Mon, 29 Jan 2024 15:06:20 GMT

Could you please assign the messaging service usage to another certificate (you can create a new self-signed one for that if you want) and then try to assign the portal in the real cert?

Re: unable to change "usage" of a certificate

fabioairoldi — Mon, 29 Jan 2024 15:12:20 GMT

Mmm... I now notice that I can't assign the usage of "ISE messaging service" to any other certificate, be it a new self-signed one or old, not used ones. If I edit the usage of another cert, such as a newly created one, I can select every other usage but not "ISE messaging Service"

Re: unable to change "usage" of a certificate

fabioairoldi — Mon, 29 Jan 2024 15:21:11 GMT

DIT - I apologize, I was able to switch the usage for ISE messaging service to another sllef-signed cert and i now can use the real cert for portal usage.

many thanks for the help!

Re: unable to change "usage" of a certificate

Aref Alsouqi — Mon, 29 Jan 2024 15:37:30 GMT

You're welcome.