Ise 3.2 - Can I recreate Internal Root Cert

[oscardenizjensen]

I have Internal Root Cert for ISE, but I want to delete it and create new one with different CN.

But I didn't want to delete it before knowing whether is it possible to create new Internal Root Cert for ISE? And if yes how do I create a new Root Cert on ISE?

Regards

[Flavio Miranda]

@oscardenizjensen 

Check this POST

https://community.cisco.com/t5/network-access-control/ise-3-0-upgrade-regenerate-the-root-ca-chain/td-p/4467411 

[oscardenizjensen]

Thanks, but when I try to delete a CA i get the below error

[Flavio Miranda]

Because the certificate is being used by ise01-poc.  You probably have more than one ISE box, right?  This ise01-poc probably is a PSN and is using the certificate.

[Aref Alsouqi]

After you regenerate the root CA cert on ISE the new cert will be propagated across the nodes. Once that is completed the old cert should show as not in use. Only then you can remove it.

[MHM Cisco World]

I will send you PM 

MHM

[Aref Alsouqi]

Actually, I've just looked into this, when you regenerate the root CA certificate, it would replace the old one.

[oscardenizjensen]

I have regenerated Root CA, but I can not change any values. Now I ended up with 2 set of root CAs and I can not remove any of them

[Aref Alsouqi]

What do you mean you can't change any values? what values are you looking to change? if you try to delete the old ones do you get any error?

[oscardenizjensen]

I have regenerated new root cert chain. So when I try to remove the old ones I get this error

Also I wanted to create manual CN value for root cert etc, but i did not have the option to do so while regenerating the root CA

[Aref Alsouqi]

Could you please check if any of the identity certificates that you have in System certificates page is still associated with any of the old chain? also, could you please try to remove the identity certs that have "not in use" next to them and try to remove the old chain afterwards?