CSCus84706 Error when attempting to renew node system cert

[gschmitt.ngit]

Hi,

I'm running version 2.2 patch 9 and I'm hitting an error when I attempt to renew the system cert. The cert is a 3rd party signed wildcard. The current one expires on 12/22/18, and the new one I have was valid as of 10/22/18. The bug causes ISE to throw an error stating that there is already a cert with the same subject name but a different serial number.

The bug report says that it has been 'fixed' but does not list a working version.

The work around is to remove the old cert and then import the new one. This is not really and option when it is the admin, eap, and portal cert.

Has anyone figured out how to get past this issue?

Thanks,

Greg

[Jason Kunst]

Did you check with the TAC?

[gschmitt.ngit]

Not yet Jason. Was hoping someone had gotten an answer already.

[Jason Kunst]

This is critical time limit would work through them ASAP

[gschmitt.ngit]

Yeah. If no one replies tonight I'll be opening a TAC case in the morning.

[Arne Bier]

You can try to get the cert re-issued with a different Subject Common Name.  The Subject Common Name is pretty much pointless these days.  web sites don't use it if the SAN has a DNS entry that matches the FQDN.  And for EAP it's not used.

Might be an option.

[gschmitt.ngit]

That may end up being our solution if the bug, in fact, has not been 'fixed'

[Damien Miller]

I've also found that you can just change a single character in the subject fields. It seems ise doesn't care if the CN is the same. 

Change any part of organization, location, state, or country.

[Surendra · Accepted solution]

The fix for the bug mentioned above is not to allow two certificates with the same subject name instead replace the old cert with the new cert. This is why you see it marked as fixed.

What you can do as @Damien Miller mentioned, you can change any filed in the subject  (CN,OU,C,O,L,ST) by as small as a single letter and get a certificate. This would mean that you would have a certificate with a different subject name and you should be able to install the certificate without any problem.