Cisco Ise certificate expired

[Giesseffe]

I have the following three expired certficates on Cisco ISE.

1. Default self-signed server certificate (expired on 06 Nov 2019)
2. DST Root CA X3 Certificate Authority (expired on 30 Sep 2021)
3. VeriSign Class 3 Secure Server CA - G3 (expired on 08 Feb 2020)

Since we have to update to version 2.6 can we prooceed to delete them without any problems?

Alternatively, is it possible to renewal them with a internal ise procedure?

Thanks a lot

[Mark Elsen]

 - As far as renewal procedures is concerned , you may want to check these documents :

     https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217191-configuration-guide-to-certificate-renew.html

   https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

 M.

[Greg Gibbs · Accepted solution]

See the following posts related to the public signed certs:

OK to delete DST Root CA X3 Certificate Authority ? 

[ISE 2.3.7] How to renew the 'VeriSign Class 2 Secure Server CA - G3 in Trusted Certificates. 

If the self-signed cert does not have a usage attached, you can delete it. If it does have a usage attached (e.g. SAML,  pxGrid, etc), you should generate a new self-signed certificate for that usage, then delete the expired cert.