DNA Center version 2.2.3.5，ISE Version:3.1.0.518 Patch Information:1,3
I verify by replacing the certificate,
[Fri May 27 03:25:03 UTC] maglev@192.168.131.2 (maglev-master-192-168-131-2) ~
$ maglev cluster network display
[administration] password for 'admin':
cluster_network:
cluster_dns: 169.254.20.10
cluster_hostname: CISCODNA
cluster_subnet: 169.254.48.0/20
cluster_vip:
- 10.204.131.32
- 192.168.131.3
container_subnet: 169.254.32.0/20
$ ll
total 72
drwx------ 2 maglev maglev 4096 May 27 02:06 ./
drwxr-xr-x 9 maglev maglev 4096 May 27 03:25 ../
-rw------- 1 maglev maglev 1976 May 26 08:26 DNAC.csr
-rw------- 1 maglev maglev 1350 May 27 01:37 cernewrootder.pem
-rw------- 1 maglev maglev 2533 May 27 01:42 cernewsubder.pem
-rw-rw-r-- 1 maglev maglev 1809 May 26 08:38 certnewdna-0526.cer
-rw------- 1 maglev maglev 2504 May 27 02:03 certnewdna-0526.pem
-rw-rw-r-- 1 maglev maglev 2544 May 26 08:48 certnewdna-0526base64.cer
-rw-rw-r-- 1 maglev maglev 1372 May 26 09:22 certnewrootbase64.cer
-rw-rw-r-- 1 maglev maglev 955 May 26 09:22 certnewrootder.cer
-rw-rw-r-- 1 maglev maglev 2574 May 26 09:20 certnewsubbase64.cer
-rw-rw-r-- 1 maglev maglev 1828 May 26 09:19 certnewsubder.cer
-rw------- 1 maglev maglev 3243 May 26 08:26 csr.key
-rw------- 1 maglev maglev 6387 May 27 02:06 dnac-chain.pem
-rw------- 1 maglev maglev 516 May 26 08:26 openssl.cnf
-rw-rw-r-- 1 maglev maglev 4268 May 26 01:50 ''$'\351\243\236\345\241\224\345\257\206\347\240\201''.txt'
$ more openssl.cnf
req_extensions = v3_req
distinguished_name = req_distinguished_name
default_bits = 4096
default_md = sha512
prompt = no
[req_distinguished_name]
C = CN
ST = Ordos
L = Ordos
O = envision-aesc
OU = IT
CN = CISCODNA
emailAddress = lin.yang2@envision-aesc.com
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage=serverAuth,clientAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = CISCODNA
DNS.2 = pnpserver.DomainAssignedByDHCPDuringPnP.tld
DNS.3 = *.envision-aesc.cn
Question 1: I am planning to integrate DNA and ISE, but it is reporting an error. I don't know why?
Question 2: Judging from the error message, the certificate is wrong. I need to replace the certificate on the DNA, but I followed the steps step by step. There is an error in the process of replacing the certificate, but I don't know why?
Question 3: How do I set the openssl.cnf file correctly, is there any case? The cisco documentation doesn't explain this well, I don't know what should be paid attention to?
