ISE - Deploy certificate .cer (portal)

[CSCO12052314]

Hello.

I have a question about certificate deploy. Currently, I’ve a public certificate that is being used to portal guest, but this one is expired. So, our costumer has generated a new cert using the same public CA, but this cert has no PVK, and I can’t export other format instead of “.cer”. I can’t import .cert, because is mandatory be a .pem + pvk and a password.

I know that the normal and the easiest way is to generate a "csr", sign and then bind this one, or get a correct certificate (PEM + PVK), but:

I ever have listened that is it possible to manipulate the certificate chain of the expired certificate, but I have no sure if it’s possible.  Have ever anyone manipulated the chain of the certificate to be possible import a “.cer”?

Note.: I’m trying to use that one “.cer” on “System Certificates”

ISE Version: 2.4.0.357

Regards.

[hslai · Accepted solution]

We cannot import a system certificate with only the certificate and without the corresponding private key.

Please ask how the customer generated the new certificate. Some public CA might re-use the CSR that provided previously and then it would use the same private key. If the previous certificate is one of ISE server certificates, then just export it with the private key and re-import the private key with the new certificate.

[CSCO12052314]

 Hello.

Thank you for your information.

Unfortunately, our customer hasn’t re-used the same CSR, he has excluded the old certificate and generated a new one, there aren’t any relation with old cert. So, I guess that have no way; we must get a certificate with PVK.

[ahollifield · Accepted solution]

Correct^ The best and most secure way is to generate a CSR directly on the ISE node the certificate will be bound to.  In this case, the private key never has to leave the ISE node and will not be exposed to improper/non-secure storage.