Remove endpoint certificate from ISE internal CA

[Eric Pineda]

Hi folks,

Is it posible to remove endpoint certificates generated by ISE internal CA?

Thanks,

Eric

[Charlie Moreton · Accepted solution]

Yes, you can revoke an endpoint cert by going to Administration > System > Certificates, choose Endpoint Certificates from the Left Menu.  Select the cert you would like to revoke and click the X Revoke button.

Screenshot is from ISE 2.1

[saxenanitesh8522]

Hi

If we are revoking the certificate the users are stil able to login.

We have gone to the internal ca and revoked the certificate but the device is still authenticating and getting on-board.

[Greg Gibbs]

It sounds like ISE is not performing the revocation checks for some reason. I would suggest confirming the following:

• Verify that the internal CA/EST/OCSP responder is enabled in Admin > System > Certificates > Certificate Authority > Internal CA Settings
• Verify that the OCSP validation is enabled and using the internal OCSP responder for all of the internal CA chain certificates in Admin > System > Certificates > Certificate Management > Trusted Certificates

If both of those are verified, you likely need to open a TAC case to investigate further.

[Jason Kunst]

You can revoke but not remove (delete)

[howon]

Endpoint certificates will be removed 30 days after its expiry automatically. Revoked certificates will also be removed 30 days after expiry.

[Eric Pineda]

Thanks for the responses!

[Looi Siew Key]

Hi howon,

How if the expired or revoke certificate to be retained or extend listed in endpoint certificate before automatically delete ?

[salprevitera]

so, what you saying if the certificate expire in 2 years, it will stay there for 2 years and 30 days before it is gone....WOW