Cisco ISE 3.0 hot fix patch- do we need to remove expired certificate

[anilkumar.cisco]

Hello Team,

During patch or hotfix installation, do we need to remove expired certificate.

Actually one of the trusted root certificate is expired , not sure what is the use of that..

Also, pls let me know during hotfix upgrade , do we need to restart the ISE server..

[Marcelo Morais · Accepted solution]

Hi @anilkumar.cisco ,

 expired Certificates may cause ISE upgrade to fail, in other words, it's a good practice to remove expired Certificate before Patch or Hot Patch installation.

Note: please check the Hot Patch Release Notes, but an Application Server restart is something expected during a Hot Patch installation.

Hope this helps !!!

[anilkumar.cisco]

in hot patch upgrade or ISE Patch upgrade procedure.. non of the place this statement is written to remove expired certificate  thus got confuse..

I am also not sure what is the use of that certificate..

As it is trusted root certificate.. but i found the similar trusted valid certificate as well on the system.

Don't want to take risk with certificate so need advise.

[Damien Miller · Accepted solution]

If a trusted root certificate has expired, then anything that was using it would already be broken. A couple of the built in certs provided by Cisco have been replaced with alternates in later builds/patches and but the old remained.