topic Cisco ISE Root CA in Wireless

Cisco ISE Root CA

srikanth.soogoor — Mon, 05 Jul 2021 07:33:04 GMT

Hi all,

I have a query on onboarding iOS, Android and windows devices through Cisco ISE.

I understood that we are going to provision and onboard above devices issuing certificates.

Do ISE has Certificate authority where it can generate its own Root CA and Intermediate CA signed by root CA and device certificates signed by intermediate CA i mean profile signing CA???

Or else we need to create CSR and send it to CA to get it signed . then we have to import root, intermediate CA's to ISE. CA's like godaddy ,verisign...when we send CSR .. do they send root certificate, intermediate certificate and signed certificate??

Thanks

Srikanth

HI,After installation, ISE

Sandeep Choudhary — Wed, 26 Mar 2014 16:59:32 GMT

HI,

After installation, ISE generates, by default, a self-signed local certificate and private key, and stores them on the server. ISE authenticates itself to clients using the default self-signed certificate that is created at the time of installation. This self-signed certificate is used for both HTTPS and EAP protocols to authenticate clients. This self-signed certificate is valid for one year and its key length is set to 1024 bits. At the time of generation, this certificate is used for both EAP and HTTPS protocols.

Cisco strongly recommends installing a CA-signed certificate.(Dont use self generated certificare from ISE).

Process for certificate deployment:see the link:

https://www.youtube.com/watch?v=d-ro6P2Azl8

Regards

Yes, Sandeep is correct. You

Anas Naqvi — Mon, 31 Mar 2014 23:10:07 GMT

Yes, Sandeep is correct. You may also check the below link,

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/installation_guide/ise_ig/ise_app_e_man_cert.html

Hi Sandeep,Yes i understood

srikanth.soogoor — Tue, 01 Apr 2014 07:35:06 GMT

Hi Sandeep,

Yes i understood that. yes i do agree that Self-signed certificate is used l3 authentication and EAp-methods

During provisiong of BYOD's , i understood that client certificate is pushed to perform EAP-TLS(iOS) and credentials for Android (PEAP-MsCHAPV2). As there is no CA capability for ISE how it will issue certificates to client devices???