ISE certificate store update after CA lifetime extension

[Thomas Thiele]

HI all,

after extending the sub-ca (which issued the ISE admin + eap certs) by using same private key (just extended the expire date), we are faced with updating the ISE certificate trust store..but this seems to be impossible without major impact:

• adding the "new" sub-ca cert is not allowed in ISE 
• removing the old sub-ca cert is also not allowed because ISE certs are issued by this ca

Our "solution":

• delete all ISE ca certs (ouch!)
• delete old sub-ca
• add new-sub ca
• get new ISE eap + admin cert 

We are looking for a better way to get this done..

[hslai]

This is likely a current limitation, as recent ISE releases have an issue to deal with any certificates with the same subjects in the ISE certificate stores.

IIRC it able to replace the certificate(s) OK if using a new private key.

[Thomas Thiele]

OK, but this is no option at the moment. Extending CA certificate by using same private key is a standard operation afaik.