Cisco ISE Certificate

[patrickbyrne456305724]

Hi all,

I have a query; currently we have ISE set up where end users get authenticated via certificate issued by a CA that will soon be defunct.

So I want to set up a few (Test) end-users to authenticate their Certificate from another CA authority, and once thats ok, then migrate all users to the new CA Certificate. Can someone guide me with correct steps in doing this. I have a fear that when I add in the new CA Cert then all exisitng end users may have a problem.?

All help much appreciated

[patrickbyrne456305724]

Hi all,

I have a query; currently we have ISE set up where end users get authenticated via certificate issued by a CA that will soon be defunct.

So I want to set up a few (Test) end-users to authenticate their Certificate from another CA authority, and once thats ok, then migrate all users to the new CA Certificate. Can someone guide me with correct steps in doing this. I have a fear that when I add in the new CA Cert then all exisitng end users may have a problem.?

All help much appreciated

[balaji.bandi]

ISE should have new CA Certs, and Client need to have Root and end cert to be published to clients (for testing some users) - thorugh group policy or any other method you have.

Check below guide to configure new Certificate :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217191-configuration-guide-to-certificate-renew.html

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/215621-tls-ssl-certificates-in-ise.html

[patrickbyrne456305724]

Hi there,

Our users will get their root and cert published to clients via Active Directory etc. So I am assuming I need to get new Root CA and install it into "Trusted Certs" section and that should be it???

[balaji.bandi]

yes correct, you need to add the ISE Trust store and also clients should accept the same cert, you can do testing with test device by adding new cert before you going to do a mass deployment to all clients