Guest Certificate Renewal in ISE

[Srinivasan Nagarajan]

Hi Experts,

We're planning to renew the Guest certificate in Cisco ISE (2.6). Please note, this is Multi-domain SSL.

I've some queries:-

1.While raising CSR, have selected 'Multi-use' with PSN's. So, later on when binding the certificate, I can select the portal option.. Is it correct method or should i select only the 'portal' option when raising CSR..?

2. Since this is Multi-domain SSL, have placed CN=ise.domain.com and placed this domain in addition to the PSN domains in the SAN.. Is this correct procedure ..?

3. When viewing the existing certificate in system certificates, it shows no value in the CN. Any idea why is it so..?

Also, Can someone please give me the overview or the best pratice to get this through...?

Cheers,

[poongarg]

1. While raising CSR, it is fine to select the "Multi-use" option as this will allow to use the certificate later for other purpose as well, if required to change the certificate usage later.
2. If you want to use this certificate on other ISE nodes as well?
3. It seems the certificate CSR was not generated correctly.

Refer the below document to replace the certificate on ISE:
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116977-technote-ise-cert-00.html

[Srinivasan Nagarajan]

Hi- Thanks for the reply.

#2, Yeah, we're tying it to the multiple PSN's (01/02) in addition to the sub-domain mentioned in the CN

#3, Certificate issued to is showing as 'Multi-domain SSL'..

why is it so..? Does this imply Wildcard certificate option was checked..?

And, what if I import only the private key (from the existing working certificate) and the new server/identity certificate for the Guest portal. Will it work..?

[poongarg]

Without selecting wildcard option, ISE will not allow to leave the CN field as blank. If the existing certificate CN name is blank then it must be having Subject Alternative Name field with wildcard.

Check the below document to have detailed explanation:

https://community.cisco.com/t5/security-documents/how-to-implement-digital-certificates-in-ise/ta-p/3630897

Hope it will help.