topic Re: ISE system certificates renewal in Network Access Control

ISE system certificates renewal

Da ICS16 — Fri, 23 Aug 2024 17:39:41 GMT

Dear Cisco community,

We are planning to ISE renewal certificates "System Certificates".

There are 3 Nodes of deployment nodes ( PAN, 2nd Node, pxGrid node ).

Could you share process to renewal it?

Remark:

- ISE "Trusted Certificates" is not expired.

- ISE integrate with AD

Thanks,

Re: ISE system certificates renewal

Ambuj M — Thu, 22 Aug 2024 10:04:15 GMT

call TAC and get their help if you have never done it before.

basically you have 2 ways and depends on how you issue certs, some people do it individually per node, some people do a single cert with multiple SAN (subject alternative name) which is more common for small deployment.

Basically you will generate a new CSR, add SAN fields with fqdn of each nodes (up to 5 allowed per cert), export the CSR, get is signed by the same CA for which you have trusted certificate, bind the signed certificate with CSR, then export the certificate with private key and import in rest of the node one by one.

more details here

Re: ISE system certificates renewal

Da ICS16 — Thu, 22 Aug 2024 15:14:35 GMT

Hello @Ambuj M,

Thanks for commend.

Re: ISE system certificates renewal

Da ICS16 — Fri, 30 Aug 2024 06:33:24 GMT

Hello @Ambuj M ,

Based on your experience, is there any impact to endpoint PCs and MAB or not if perform renewal only ISE "System Certificates" ?

thanks for your supporting.