topic Re: CErtificate guest ISE in Network Access Control

CErtificate guest ISE

athan1234 — Tue, 15 Jul 2025 11:33:03 GMT

My customer neeed s to upgrate expaire certificate guest portal .

I n my head allwys has the same create rthe CSR and after of taht bind the certificate . I always made this way for what if you fgenerete the csr from ise the key is inide and ypu pas the private key and after of that whn the customer recive the csr an bind fort oytr part thereis no a key file it is more esay( this is my terohi i founfd lonh time ago maybe the explication is not good)

My customre pass to me the diferent file when i tried to bind i recibve this erros

I forgot which file i need to use for bind i chosse

in the first toime i tried to use .crt

I get the errror first it is necesary toi put in trusted i puttting in truisted i get this errro r

ANd i tester with .pem another error.

I am seraching in google and the solucion i see it is create a note pad with 3 certificates .cer.cert.and intermedete . and save .pem and trynt to binded it is a good solution

Re: CErtificate guest ISE

Rob Ingram — Tue, 15 Jul 2025 11:57:21 GMT

@athan1234 the new certificate has the same attributes as the existing certificate, and you cannot import the new certificate unless these are different, hence the error.

Either create a new certificate, with slightly different attributes or temporarily assign the guest portal usage to another certificate on the same node. Delete the expiring guest certificate and then install the new guest certificate and assign the usage.

Re: CErtificate guest ISE

athan1234 — Tue, 15 Jul 2025 12:20:45 GMT

Thank you for the clarification! That makes sense - the error is because there's already a certificate with the same attributes installed in ISE.

Just to confirm, these are the steps I should follow:

Temporarily change the portal certificate assignment:
- Go to Administration > System > Certificates > Certificate Management > System Certificates
- Find another valid certificate (can be the ISE self-signed certificate)
- Edit its "Usage" and check "Portal"
- Save the changes
Delete the old certificate:
- Once the portal is using a different certificate, find the old "xxxxxxxxxres.com" certificate
- Select it and click "Delete"
Bind the new certificate:
- Select my CSR (Certificado_Guest_Portal_2025)
- Click "Bind CA Signed Certificate"
- Use the file xxxxxxxxxxxcom.crt (just the certificate file, not the bundle)
Assign "Portal" usage to the new certificate:
- Once imported, edit the new certificate
- Check the "Portal" checkbox in Usage
- Save the changes

Is this the correct process? Should I use just the certificate file (.crt) for the bind, or do I need to include the intermediate certificates in a bundle?

Re: CErtificate guest ISE

MHM Cisco World — Tue, 15 Jul 2025 12:21:14 GMT

Re: CErtificate guest ISE

Rob Ingram — Tue, 15 Jul 2025 12:24:02 GMT

@athan1234 yes the procedure looks ok, perhaps backup the old certificate before deleting (just in case).

As it's the same issuer issued the new certificate the intermediate root certificates that are part of that bundle should not be required to be imported again.

Re: CErtificate guest ISE

athan1234 — Tue, 15 Jul 2025 12:48:51 GMT

I get this error: 'The certificate is already expired.' My customer is aware of this. When I try to delete it, I get this error

Re: CErtificate guest ISE

Rob Ingram — Tue, 15 Jul 2025 13:18:45 GMT

@athan1234 change the usage of a temp certificate to portal or you could just modify those portals and change the certificate tag. Then you can complete the task of importing the new certificate.

Re: CErtificate guest ISE

athan1234 — Tue, 15 Jul 2025 13:02:37 GMT

How can I modify the portal? My brain's not working properly today.

Re: CErtificate guest ISE

Rob Ingram — Tue, 15 Jul 2025 13:18:02 GMT

@athan1234 select a temp certificate and change the usage to "Portal"?

Re: CErtificate guest ISE

Dustin Anderson — Tue, 15 Jul 2025 19:29:05 GMT

Just to clarify, edit a temp certificate to use, add the portal and select the default portals from the drop down menu to reassign them. I think just selecting portal won't reassign them directly.

Re: CErtificate guest ISE

athan1234 — Wed, 16 Jul 2025 07:36:22 GMT

@Rob Ingram @Dustin Anderson

Ok i did it . Whne i tritd to add the bind i recived an error . But now.

I am using a certificate with the .crt extension.

When I added it to the trusted certificates, I received this warning

Re: CErtificate guest ISE

Dustin Anderson — Wed, 16 Jul 2025 12:50:44 GMT

ok, the first error is expected as when you reassign the portals they restart to apply the cert. This is not a system restart so not disruptive. I have not seen the second error, but question is when you got the cert, did you get just the cert, or is it the cert with chain? I usually load the cert with chain.

Re: CErtificate guest ISE

athan1234 — Thu, 17 Jul 2025 09:49:12 GMT

I don't know, always I pass to the customer the CSR and then they pass to the company certificates my CSR and the pass to me the fiklles join and afetr taht i bingd the certicficae they pass to me alwys forget wich one is the certificate extension i need to bind . But in this case ima having issue

Re: CErtificate guest ISE

athan1234 — Mon, 21 Jul 2025 14:49:18 GMT

The problem now is that I selected the portal for another certificate. for replace the earlier one, but now when the customer try to connect, the portal doesn't appear. can I select the last certificate with the portal and check the option for the portal so that it can work, at least.

Re: CErtificate guest ISE

athan1234 — Fri, 22 Aug 2025 10:33:24 GMT

Hi, at least I was able to install the new certificate. However, now I’m getting this “stale” error.

I want to mention that two years ago I had the same “stale” error. At that time, I reloaded the ISE, and it was resolved. Now, I reloaded the ISE again, but I’m getting the same result. Any ideas?

Re: CErtificate guest ISE

MHM Cisco World — Fri, 22 Aug 2025 10:43:23 GMT

Can I see what you get from Question mark ""?""

And I am sorry I little weak in Cert but I try help you here

MHM

Re: CErtificate guest ISE

athan1234 — Fri, 22 Aug 2025 11:33:27 GMT

Thank you for your reply and assistance.

There is no question mark, and you cannot see any details; it only shows a stale state.

Re: CErtificate guest ISE

Rob Ingram — Fri, 22 Aug 2025 11:43:17 GMT

@athan1234 from the Cisco docs - "Stale certificates are certificates that don’t belong to any node in the deployment. These redundant certificates might accumulate in large numbers in the System and Trusted Certificate stores, leading to insufficient memory and latency issues. From with Cisco ISE Release 3.1, such redundant certificates carry a Stale Certificate status, enabling you to review and delete them"

https://www.cisco.com/c/en/us/td/docs/security/ise/3-3/admin_guide/b_ise_admin_3_3/b_ISE_admin_33_basic_setup.html#concept_a1f_v2t_msb

What is the current state of the certificate, what is attached to the portal?

Re: CErtificate guest ISE

athan1234 — Mon, 25 Aug 2025 10:34:30 GMT

Hi Rob, thanks for your reply.

I think I will need to generate a new CSR including the SANs I mentioned, and then send it to the provider to issue the certificate with the full PEM chain.

My question is: do I need to explicitly ask the provider to add the hostname ( NODE ISE ) or will it be enough if I include it in the CSR SANs when I generate it?

Re: CErtificate guest ISE

Rob Ingram — Mon, 25 Aug 2025 09:40:01 GMT

@athan1234 recreate the CSR yourself with the correct attributes and send to the provider for signing, rather than let the provider create a new CSR.