ISE 3.0 Upgrade + Regenerate the Root CA Chain

[michael.evdokimov]

Hi all, 

I have noticed in the ISE 3.0 Post Upgrade notes that it mentions that the Root CA chain must be regenerated.

Cisco ISE 3.0 Upgrade Guide: Post-Upgrade Tasks - Cisco

My question is two fold: 

1. Will this impact endpoints that have already auto enrolled for certificates via the ISE internal CA? 
2. Do I have to push the new certificate chain to endpoints that have already enrolled to ISE internal CA? 

I am wary of the impact this may cause,, as the customer this upgrade is for has tens of thousands of endpoints with ISE supplied certificates 

Cheers,

Michael

[Greg Gibbs · Accepted solution]

When you re-generate the Internal CA Root Chain, ISE does not delete the old one automatically. As long as ISE retains the old Root Chain, it will trust certificates presented by the endpoints with identity certificates signed by that chain.

[jherrera2]

After upgrading from 2.7 to 3.1. I'm now receiving the Queue Link Error. Cisco advised to replace the Internal Root CA. I wonder if that's our case. We have 2 nodes and they in sync. ISE messaging is up and running and under Internal CA settings, the internal CA authority is up for both nodes. Will this affect the certificate installed in the workstations? Our used signed by the local CA of the company.

Thanks, JC

[sergioparl]

Question, does regenerating the ISE Root CA require or cause a reboot of the ISE appliance?

[ahollifield · Accepted solution]

No

[sergioparl]

Awesome. Thank you