ISE 2.7 Renewal of ise messaging service certificate

[mmisonne]

Hello

I use ISE version 2.7.

I need to renew an ISE Messaging  service certificate because it is expired

How can I do it ?

If I use "generate self signed certificate", I do not have the option to generate a certificate for ise messaging service.

Michel

[hslai · Accepted solution]

Choose Administration > System > Certificates > Certificate Management > Certificate Signing Request. Choose the usage ISE Messaging Service.

[mmisonne]

So, it is not possible to do it with the "generate self signed certificate" option  like we can do it for  Admin/EAP/Portal. certificates. We need to do it with a PKI.

I notice also that , it the option "Use "ISE Messaging Service" for UDP Syslogs delivery to MnT " is activated, we need to generate Certificate for ISE messaging from a PKI. If we leave the default "ISE messaging certificate" self generated, the Syslog messages will not be accepted by  the MNT and the log will be empty.  

[fitzie]

This methodology does not work for me.  There simply is no option to select an ISE Messaging Service type of certificate.

I am using an external CA, therefore the internal CA is disabled.

I am running ISE v3.1p3

I am running in FIPS mode.

[M.Jallad]

Hi Michel,

Did you have a solution for this by any chance ? 

I think we ran into the same issue ; and we had to disable the default option and use udp 20514 to be get live logs running on the MNT.

Regards,

Muayad,

[mmisonne]

Hi Muayad

The solution I found , at that time, was to do an …."application reset config"

It will loose everything  except first setup, IP-addr..) and it will recreate all self-signed certificate.  

Michel

[Damien Miller]

The method @hslai provided from the CSR page is the correct way to renew the messaging service certificate. This is not a CSR in the traditional sense where you get a CSR file to fill elsewhere. When you select the "ise messaging service" option from the list, it will generate a new deployment signed certificate for each node and install it. This is a one stop shop action to replace the expired messaging certificate. 

[Alex Martin]

If anyone is still facing this issue in 2023 and they are using a third party PKI, the key here to be allowed to re-generate this certificate is that the Local CA in ISE must be enabled first.

Navigate to Administration > System > Certificates > Internal CA Settings and Select Enable Certificate Authority

Then go to Administration > System > Certificates > Certificate Signing Requests and in the dropdown select ISE Messaging Service and Click Generate ISE Messaging Service Certificate.

When the new certificate is generated you can check for it in the Administration > System > Certificates > System Certificates and then delete the previous one and then return back to Administration > System > Certificates > Internal CA Settings and Select Disable Certificate Authority.

Cheers,

Alex