Baltimore CyberTrust Root is expired on cisco ise

[oumodom]

Baltimore CyberTrust Root is expired. 

As we found it on Trusted Certificates on ISE. 
This certificate will expire soon. When it expires, ISE may fail when attempting to establish secure communications with clients. Inter-node communication may also be affected.

Description: Auto imported for secure connection to cisco.com/perfigo.com

Usage: Trust for authentication of cisco services

Valid From Sat, 13 May 2000 01:46:00 ICT
Valid To (Expiration) Tue, 13 May 2025 06:59:00 ICT

Suggested Actions Replace the certificate. For a trust certificate, contact the issuing Certificate Authority (CA). For a CA-signed local certificate, generate a CSR and have the CA create a new certificate. For a self-signed local certificate, use ISE to extend the expiration date. You can just delete the certificate if it is no longer used.

How to resolve this issue? 

Thank you, 

[Leo Laohoo]

Raise a TAC case.  

If this is correct (and widespread) TAC will need to release a patch soon-ish and a Field Notice will need to be fast-tracked.

[oumodom]

As your experience, this is the new issue ? @Leo Laohoo 

[Leo Laohoo]

For everyone's sake, pray that I am wrong.

[langflow]

The expired Baltimore CyberTrust Root is causing authentication problems—hoping Cisco provides a smooth fix or workaround soon!

[Leo Laohoo]

@Marvin Rhodes, 

Would you have an idea what "Baltimore CyberTrust Root" cert does and what happens (i.  e. what "breaks") when this specific cert expires?

[tipy]

A reply from Cisco would sure be helpful and informative so not everyone have to make a TAC case, but by the description it seems this is only used to trust access to "cisco.com/perfigo.com"
When I look at that domain now the cert is issued by IdenTrust Commercial Root CA 1 and this is also present in the ISE trust store. 

[Leo Laohoo]

@Arne Bier has shared CSCwo05386.

[oumodom]

So we is next besides from contacting to TAC? @Leo Laohoo  @Arne Bier 

[Leo Laohoo · Accepted solution]

Look at the details found in CSCwo05386.

1.  The Bug ID was created today, 12 February 2025. 

2.  Yet, there are already >31 TAC Cases. 

That is 31 TAC cases in less than 24 hours.  This means ISE TAC is currently getting swamped and have no time to update the Bug IDs. 

Options are: 

1.  Raise a TAC Case and get "associated" to this Bug ID

2.  Contact/Escalate your Cisco Account Manager/SE

3.  Wait for TAC to provide further information.

[oumodom]

3.  Wait for TAC to provide further information.

I am looking forward to getting response from Cisco.

[Arne Bier · Accepted solution]

There is a bug filed to track this

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwo05386

[Leo Laohoo]

Thanks for sharing the Bug ID, @Arne Bier.

[victormanuelsolis]

This certificate is for the air-gapped devices as well? I mean no internet connection ISE?

[Wilson-Qi]

Alarm Name :

Certificate Expiration

Details :

 Trust certificate 'Baltimore CyberTrust Root' will expire in 90 days : Server=XXXXX

Description :

This certificate will expire soon.  When it expires, ISE may fail when attempting to establish secure communications with clients.  Inter-node communication may also be affected

Severity :

Warning

Suggested Actions :

Replace the certificate.  For a trust certificate, contact the issuing Certificate Authority (CA).  For a CA-signed local certificate, generate a CSR and have the CA create a new certificate.  For a self-signed local certificate, use ISE to extend the expiration date. You can just delete the certificate if it is no longer used

*** This message is generated by Cisco Identity Services Engine (ISE) ***