topic Re: How do I install a wildcard certificate in ISE? in Network Access Control

How do I install a wildcard certificate in ISE?

JustTakeTheFirstStep — Tue, 03 Sep 2024 12:40:11 GMT

I want to install a wildcard certificate.
I've been handed a wildcard certificate by an end user.
I want to know how to install the certificate.
The guide provided by Cisco says to use a CSR to generate the certificate and then bind the .pem file.
But what if I already have a wildcard certificate in use, how do I install it?

Re: How do I install a wildcard certificate in ISE?

Rob Ingram — Tue, 03 Sep 2024 12:47:33 GMT

@JustTakeTheFirstStep you don't need to create a CSR from ISE. If you have the certificate generated elsewhere you can import the certificate as per your first screenshot. Just select the certfificate file, key file, define the password and Check "Allow Wildcard Certificates".

Re: How do I install a wildcard certificate in ISE?

MHM Cisco World — Tue, 03 Sep 2024 13:12:56 GMT

https://community.cisco.com/t5/security-knowledge-base/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Check this link

MHM

Re: How do I install a wildcard certificate in ISE?

JustTakeTheFirstStep — Wed, 04 Sep 2024 04:07:01 GMT

@MHM Cisco World @Rob Ingram

https://community.cisco.com/t5/security-knowledge-base/how-to-implement-digital-certificates-in-ise/ta-p/3630897

According to the guide, use the pem, pvk extension.
However, the certificate file I have does not have the pem, pvk extension.
Which file do I need to import?

Re: How do I install a wildcard certificate in ISE?

JustTakeTheFirstStep — Wed, 04 Sep 2024 04:10:15 GMT

@MHM Cisco World

According to the guide, should do a CSR.
As I said, I have a certificate issued by a CA.
So I don't need to do a certificate request (CSR).
I am looking for a way to install the certificate without doing a CSR.

What do you think?

Re: How do I install a wildcard certificate in ISE?

Marvin Rhoads — Wed, 04 Sep 2024 04:16:12 GMT

You have to have a copy of the private key file. That would be available from the system that was used to generate the CSR initially. Without the private key, it is not possible to install the wildcard certificate as a system certificate in ISE. That's fundamental to the nature of how Public Key Infrastructure (PKI) works.

Re: How do I install a wildcard certificate in ISE?

JustTakeTheFirstStep — Wed, 04 Sep 2024 05:07:00 GMT

I have a .key extension file.
Do I need the .pvk extension?

Re: How do I install a wildcard certificate in ISE?

Rob Ingram — Wed, 04 Sep 2024 06:40:09 GMT

@JustTakeTheFirstStep as already stated in the first reply, you do not need to create a CSR on ISE. To import, you will need the certificate, private key, and encryption password, which you seem to have from your screenshot. Certificates that are imported into Cisco ISE must be in privacy-enhanced mail (PEM) or distinguished encoding rule format. You may need to convert the file using openssl or another method.

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_basic_setup.html?bookSearch=true#concept_8ECCCAF1252E40DDB9A786C0AC7BC3B2

Re: How do I install a wildcard certificate in ISE?

Marvin Rhoads — Wed, 04 Sep 2024 13:42:51 GMT

@JustTakeTheFirstStep the key file extension is not important or mandatory. It appears from your screenshot that your .key file is most likely an Encrypted Private Key - you can verify by opening it in a text editor: the plain text will confirm it. In that case, you simply provide the password (most likely from, the password.txt file you showed) in the Import Server Certificate dialog box.