error message "EST Service not running" since upgrade to 2.4

[John Vierra]

Ever since I upgrade to 2.4 I'm getting this error message "EST Service not running". If I look in the CLI is says its not running. Any ideas?

[hslai]

I already responded and suggested to meet and check this out.

[chhess]

Hello, i am having this same issue.  I see this is marked as "Solved" but there is not any information on what fixed this issue.  Is this the same bug as CSCvj11319, we upgraded from 2.2. 

[hslai · Accepted solution]

Yes, it's the same issue as CSCvj11319.

In John's case, he re-generated the ISE internal CA certificate chain.

[chhess]

Thank you for the information!

[Damien Miller]

for others that may find this, I would do this after the entire deployment has been upgraded, not just the after the PAN completes.

[kangkungkok]

hi   hslai

How do I create an ISE internal CA certificate chain?

[Damien Miller · Accepted solution]

To fix the EST service not running following an upgrade just follow these screenshots.  I suggest engaging TAC if you are have problems or need help though. Make sure you weren't using the existing prior to this, if unsure contact TAC. 

Click on Generate CSR highlighted

Then Select "Root CA" and click replace ISE root CA certificate chain.

[anil.kumark]

We tried this workaround in from CSCvj11319 bug but no luck. We are not using internal CA.

[Jason Kunst · Accepted solution]

Open a tac case
More information about getting help under resources http://cs.co/ise-help

[csco10979295]

Is there anyway to disable EST services only ?

[m.soleimani]

Hi Dear Damien Miller

I have the same problem on one of my PSN and I did your solution but it didn't work for me, any help?

[Damien Miller]

I would reccomend contacting TAC if the process did not work. I have run in to issues since this thread where a cert db file may need to be cleared out from root.