ISE CA Certificates

[alberx]

I´m using ISE 2.1 as CA for BYOD and deploying user certificates to devices. Everything works fine in the provisioning and EAP authentication.

Taking prrofit of the ISE CA I would like to use it for other platforms, I mean servers, proxies.... I would like to know if it is possible to sing certificates for other subordinates root CA´s or servers.

I also exported root CA certificates and private keys by CLI, trying to import them to another CA server but the file is encrypted, of course I know the password, but it is a file with no format.

Does anyone knows if it is possible to use ISE CA as an "standard " PKI CA server?

Thanks.

[Bernardino Tellez]

Technically you can use ISE as a CA. However, this is not recommended because most likely it will not scale.

What is not clear to me is why you are trying to export the root certificate and private key and import it to another CA. Can you add more details?

@berna_tllz

[alberx]

Hi Bernardino.

I want to use ISE root certificate ( or to sign a subordinate Root certificate) for a proxy service and intercept SSL.

As my client endpoints already have this root certificate installed via the BYOD provision process I would like to take profit and avoid the necessity to distribute another certificate to my clients. Much of them are private devices and I can not control them.

Thanks.

[Bernardino Tellez]

What you can do is to deploy a Root CA (if you don't have it yet) and make the PAN a subordinate of that CA. In that way, all the endpoint certificates will trust the Root certificate. In that scenario, you can use your Root CA to sign the proxy's certificate without trust issues from the BYOD clients. This will also help you with any other service that requires a certificate.

The downside is that you will need to redeploy the BYOD certificates. You can read about this in the following link:

http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_0111.html#task_E458E69FA39941BBAA9799AAD7FDC644

 Twitter: @berna_tllz

[alberx]

Yes, I already knew this.

But my client still does not have PKI infrastructure and I don´t want to create it for them.

Thanks anyway.