ISE 2.4 CA signed Certificates expired but ISE services still accessible

[girish_gavandi]

Hello,

I was working on a ISE 2.4 deployment (patch 5) and found that the CA signed certificates were expired. Strangely, the ISE admin, portal, RADIUS etc. services were accessible. From what I read, this shouldnt happen.

Ultimately, the moment I tried to install the latest patch, ISE restarted its services and ISE nodes stopped communicating within the deployment.

Wonder what caused the nodes to keep running even after certificate expiry?

Any insight/information would be great.

Regards,

Girish

[thomas · Accepted solution]

All ISE portals and services will continue to function even with default self-signed or expired certificates. RADIUS and TACACS may function without CA-signed certificates.

Your endpoints and/or users, however, may not decide trust ISE as an authentication server depending on the supplicant configuration or risk tolerance.