Hello @Srinivasan Nagarajan
I assume the new Intermediate CA cert is already available to you?
And this is an internal PKI CA or from a public CA provider?
I would do the following:
Import the new Intermediate CA 2 cert into the ISE Deployment under Trusted Certs. This is not service affecting - it's done in preparation for the new ISE System Certs that you're about to start using Issued by the new CA2.
On ISE PAN, create a CSR (Certificate Signing Request) in ISE for a new Admin Cert and include both ISE nodes.
Then, create another CSR (Certificate Signing Request) in ISE for a new EAP Cert - and put ticks against both ISE nodes.
The reason I split EAP and Admin is so that you can treat them individually - changing an Admin cert always causes downtime (application restarts), whereas replacing the EAP cert causes no downtime. They might look similar in the end, but splitting them can have operational advantages. If cost is an issue, then create a multi-use cert instead to keep the number of certs low.
Send the CSR's to your PKI team and get the certs created. You should receive new certs back: Admin Cert for ISE1/2 and EAP Cert for ISE1/2
In a maintenance Window perform the Bind of Admin CSR for your Secondary ISE node by supplying the new Admin cert. This will cause the Secondary Admin node to restart - ensure it comes back with the new Admin cert by opening a browser to the Secondary node and inspecting the cert. You can of course also just check in the PAN GUI but I like to do both.
Now bind the Primary Admin's CSR with the new Admin cert. As always, applications will restart and eventually you will be able to log back into the GUI. That was the disruptive part.
Replace the EAP Cert only when your EAP clients (supplicants) are ready/prepared. Why? Because As soon as you replace the ISE EAP cert, it could affect the EAP clients that use ISE. If the clients are configured to trust ISE then your clients MUST have the NEW CA2 cert in their own trust store. So make sure they have that pushed to them via Group Policy (Windows) or via the MDM.
When you replace an ISE EAP cert it's not service affecting. You can only have ONE EAP cert per ISE node - it will replace the old one.
BTW - browser certs (ssl/https) should be generated with max life span of 1 year, since Apple and other browsers will start rejecting longer-living certs from 1 Sept 2020. You can still make them 2/3 years before then. This new rule only applies to certs that are created after (or VALID FROM) 1 Sept.
EAP certs can be longer than 1 year - depends on your security people - if you want to save yourself this hassle every year then make the cert live a bit longer.
Hope that helps.
regards
