Hey guys,
Okay here is the scenario, We have One ISE node. One ASA5525x on which Anyconnect users land. We have given the users their username/password's.
They authenticate via their username/password's & get connected via anyconnect. Then they get a certificate from ISE via SCEP & now they have the user certificate installed on their device.
They again login via their certificate's this time. Plus, we have the ISE acting as an OCSP for certificate revocation checks.
So, ISE has two roles here, SCEP & OCSP. Now the certificates given to the AnyConnect users have an expiry date, we need to renew their certificates before the expiry date. We don't want them to go through the whole certificate install process again.
