ISE Certificate stale status

[Anilvnair]

Hello Members,

I see after the certificate binding on ISE, the cert status as Stale, under the system certificate tab. How to fix this issue?

[ahollifield]

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_basic_setup.html#concept_a1f_v2t_msb

[ahollifield · Accepted solution]

Stale System and Trusted Certificates

Stale certificates are certificates that don’t belong to any node in the deployment. These redundant certificates might accumulate in large numbers in the System and Trusted Certificate stores, leading to insufficient memory and latency issues. From with Cisco ISE Release 3.1, such redundant certificates carry a Stale Certificate status, enabling you to review and delete them.

[thomas]

Did you search for the word "stale" in the ISE Admin Guide?

ISE 3.1 Administrator Guide > Basic Setup

[ffischer]

In a complex deployment runnin for years now we are using seperate interfaces for the Guest Portal.
We have a Guest Portal Certificate signed by 3rd party that ist shown as stale,
because neither its' CNs nor its SANs match the fqdn of the one of the nodes.
We use "ip host" aliases for guest portal setup that ISE cert check obvoiusly forgot to consider
if an installed system certificate is referenced.

And.... Yes, I have read the manuals ... at least partially

[Gioacchino]

Hi @ffischer ,

we ran into this issue as well. Does the "ip host" fix definitely the issue?

Thx, Gio

[ffischer]

Well.. 
The certificates are cecked for beeing referenced in the ISE config
by internal code running automatically in regular intervals.
The code obviously ignores the host names in the ip aliases on the CLI.

I'm not aware of a confirmed bug nor a fix for this bug.

Nothing you or I can "fix" if you need the host alias.
If you do not need it, then delete it.