Externally-signed CA certificate not being used

[eoinwhite123]

I generated a CSR on ISE 3.2 (standalone) & binded the new externally-signed CA certificate against the CSR to the admin UI.

However the server is still presenting the old self signed certificate when I browse to the admin portal - even after multiple reboots. 

I can see its still using a self singed certificate for "ISE Messaging Service" & SAML. Do I also need to generate separate CSRs for these services before ISE admin portal will present the new externally-signed CA certificate for the admin UI?

[balaji.bandi]

what kind of cert do you have SAN or wildcard ?

check below thread may help you :

https://community.cisco.com/t5/network-security/where-can-i-go-to-ask-about-certificates-and-ise/td-p/3082946

[Sri Harsha Dasari · Accepted solution]

While Generating the CSR, Under Usage, did you select Multi-Use or Admin ? Default is Multi-Use

Under System Certificates, do you see the new certificate ? If you see it, Under Used by column, what are the functionalities you see ? If you see Admin, then it will be used for Management Portal.
Also, when you see Certificate Security Warning, did you check on the details to see which certificate is presented ? Sometimes, your browser might not trust public CA you used for ISE certificate.

For ISE messaging Service, better to leave it to use default cert, for SMAL, if you are using the functionality, you can get a separate certificate. However, either of these will not impact your Management portal certificate.

[thomas]

Verify you have properly selected the services - specifically the Admin service in your case but I would recommenda ll but SAML - to use the new signed certificate: