topic Re: Cisco ISE Trusted Certificate Renewal in Network Access Control

Cisco ISE Trusted Certificate Renewal

renzanjo-caparas — Thu, 19 Feb 2026 00:43:46 GMT

Hi everyone,

Good day and greetings!

Our Intermediate CA will expire in 60 days. Somebody told me from the organization that I should renew the Root instead. But when I check the Hierarchy in Cisco ISE it is showing "Certificate is good"

This Intermediate is the one we are really planning to renew

Two questions I have:

1. Is he correct?

2. Where can i export that Root CA to verify this chain?

Regards!

Re: Cisco ISE Trusted Certificate Renewal

Arne Bier — Thu, 19 Feb 2026 20:30:27 GMT

Hi @renzanjo-caparas

The Root CA is the CA that issues the intermediate CA(s). If it's only the intermediate CA(s) that is/are expiring, then you would not replace the Root CA - you would generate a new Intermediate CA from the existing Root CA. Of course, if your Root CA is going to expire soon, then you would have to replace the entire thing (Root + Intermediates). Perhaps that is what they meant.

You can export that Root CA from ISE Trusted Certificates section.

I tend to use openssl or XCA to test cert chains. If you only have a Windows PC, you can also import these certs (Root and Intermediate) on the PC and then click on them - the Windows cert viewer is quite handy to validate CA cert chains.

Re: Cisco ISE Trusted Certificate Renewal

renzanjo-caparas — Fri, 20 Feb 2026 00:09:35 GMT

Hi @Arne Bier ,

Thank you very much for your feedback. Is this what you meant for exporting? Will this also export the root CA? When exported, it is a PEM file. Sorry I am not much good on certificates.

Re: Cisco ISE Trusted Certificate Renewal

Arne Bier — Fri, 20 Feb 2026 03:43:39 GMT

Yep - that's the one. It will export the trusted certificate (which is a public cert - no private key involved etc.) - you can rename that file to .crt in Windows and then click on it - it will display the cert details. Or you can also install it in your Windows profile.

I tend to use openssl mostly for this.