ISE 1.3 Internal CA

[Ben Meagher]

Hi,

     I am looking for some assistance on the new local CA. My client provisions and launches the Cisco Network Setup Assistant but once I hit start, the client fails. Tail logs off the ISE node produce the following..

2015-01-09 16:00:00,155 WARN   [portal-http-service13][] com.cisco.cpm.scep.ScepCertRequestProcessor -:::::- No live PKI server found for certificate request [CN=bm
eagh01]
2015-01-09 16:00:00,166 ERROR  [portal-http-service13][] com.cisco.cpm.scep.ScepCertRequestProcessor -:::::- No live PKI server found for certificate request [CN=bm
eagh01]

A show application status ise confirms that CA is enabled and running.

Thoughts ?

[mohanak]

ScepException: No live PKI server found for certificate request

CSCun28653

[Ben Meagher]

As of this post, the above bug ID does not appear to be open to the public just yet. I have bypassed the issue by deploying fresh 1.3 images. This may not be ideal for many upgrades but it allowed me to keep moving.

[nspasov]

Mohanak, can you provide us with some details about the bug:

- Conditions

- Workaround

Etc?

[jwmolenaar]

Hi Ben,

I hit the same issue and was able to fix it by replacing the Root CA for BYOD. Perhaps this is a valid work around for this bug. To be honest: I changed the hostname and domain-name several weeks ago because my ISE is a NFR kit. So after all it looks very logically to me to replace the Cisco ISE Root CA certificates :)

Please let us know if it works for you as well.

[EvaldasOu]

Hey Buddy! It works!

I just found this discussion like 10 hours ago... rebuild all my lab environment from scratch (except ISE) , tried to replace ISE root CA certificate chain as told, and Internal CA works again!

Thank You very much! Great timing! :)

[Joshua Robertson]

Just had this same issue on ISE 2.1, replacing the Root CA Cert Chain worked like a charm.  Thanks!