Cisco ISE 1.2 wrong certificate on admin node

[Serg Romanovets]

Hello All,

I made the mistake of entering the wrong certificate on Administration ISE node. Now i can't to connect to it, because entered certificate can't be used for building https connection. I have access by ssh, but i don't now how to fix this issue from cli. Is it possible?

Thanks!

[Francesco Molino]

Hi

I've never had this kind of issue. However the cli commands are quite limited.

There is a command application reset-config ise where the 1st question is initialization of ISE and the 2nd concerning certificates. 

If this isn't a production server, try this command by saying No at the first question (factory reset of ISE) and No the 2nd question (Retain server certificates).

If it won't work, you'll need to reply Yes at the 1st and No at the 2nd question but you'll loose all config (rules and AD join).

If you have a lot of rules,.. I would suggest these steps (Except if someone else has another idea, but on my side I don't see another ways):

- Make a backup of your actual ISE through CLI (I'll paste after the link of ISE backup/restore command)

- Reset to factory as per command given before

- Export self signed certificate (application configure ise) http://www.cisco.com/c/en/us/td/docs/security/ise/1-3/cli_ref_guide/b_ise_CLIReferenceGuide/b_ise_CLIReferenceGuide_chapter_0101.html#ID-1363-0000020d

- Restore your backup from CLI (you won't be able to connect through https like today)

- Import back the certificate backup you've done just before (resetting certificate)

- Now you'll be able to connect and retrieve all your datas.

Below a link for backup/restore:

http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/user_guide/ise_user_guide/ise_backup.html#35144

Hope this answered your question. 

Thanks

PS: Please don't forget to rate and mark as correct answer if this solved your issue.

[Serg Romanovets]

ISE 1.2 do not support import/export certificate from cli, i'll try to update it to 1.3. When i imported self-signed certificate into cert store, all current certificates will be replaced by this one?

[Francesco Molino]

Yes you're right. It's been a while I'm not using ISE 1.2

Thanks 

PS: Please don't forget to rate and mark as correct answer if this solved your issue 

[Aditya Ganjoo]

Hi Serg,

You need to make sure you take a backup of the ISE before resetting the config.

If you have a valid contract you can open a case with TAC and they can delete the certificates from the root shell.

Regards,

Aditya

Please rate helpful posts and mark correct answers.