Error message when binding the certicate from a third CA

[cdmadmin]

Hello,

My first Sectigo RSA Domain Validation Secure Server CA-use certicate wa expired since 7 Aug 2021(System Certificate) and I've generate a self signed certicate. 2 days ago I've requested from a new certicate from the third CA using the existing CSR. I've received from them the certificate and the bundle as well (but note that my SECTIGO_Intermediate and Root are not expired yet, the expirations dates are Dec 2030 and Jan 2038).

After binding the certificate, I get the message below.

It's for Cisco ISE.

Please, can you assist me

[Greg Gibbs]

As the error states, ISE will not allow creating a CSR or binding a certificate that has the same Subject as another certificate. A common approach is to modify one of the certificate fields so that there is no matching Subject value.

I typically use the OU field in the certificate to indicate the Usage (Admin, EAP, etc) of the certificate to avoid duplicate Subject value issues. When renewing a certificate, I often just modify the same OU field slightly (like adding the Month/Year) to produce a unique Subject value.

I haven't seen anyone using the OU attribute as a matching condition in policies, so it is often easy to change.

[Greg Gibbs]

As the error states, ISE will not allow creating a CSR or binding a certificate that has the same Subject as another certificate. A common approach is to modify one of the certificate fields so that there is no matching Subject value.

I typically use the OU field in the certificate to indicate the Usage (Admin, EAP, etc) of the certificate to avoid duplicate Subject value issues. When renewing a certificate, I often just modify the same OU field slightly (like adding the Month/Year) to produce a unique Subject value.

I haven't seen anyone using the OU attribute as a matching condition in policies, so it is often easy to change.

[cdmadmin]

Hello Greg,

Thanks for your reply and note that I did the change on the subject ("OU" and "O") three times and get the same message.

One precision, actually I have the "Self Signed Certificate" and I want to replace it by the one signed by CA.

It's not a renew

Regards 

[cdmadmin · Accepted solution]

Hello,

I've solved my problem. While binding the CA certificate, I did not select any usage and after certificate installation, I just edit it by selecting the usage needed.