ISE Deployment Certs

[benolyndav]

HI

Issue with our ISE Deployment self signed certs have expired so deployment is out of sync, self signed certs are multi use (Admin, Portal, Radius DTLS, EAP)
Is there a certain order to renew the self signed cert and get the deployment back in sync.??

Thanks

[Rob Ingram]

@benolyndav it's the Admin cert that is used for the ISE nodes to communicate. When you replace this certificate the ISE services are restarted. Best to do this in a change window. Once all nodes have a new Admin certificate then the ISE cluster should be in sync again.

[benolyndav]

Hi 

Thanks for that, whats the best way to do this e.g what order ?? and steps, have you any good links for this info at all ?
Thanks

[Rob Ingram · Accepted solution]

@benolyndav here is the offical Cisco ISE guide to renew certificates and the steps required. https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217191-configuration-guide-to-certificate-renew.html

FYI, it's recommended not to use the self-signed certificates in production.

[benolyndav]

Hi

Again Thanks

When the ISE is installed, it generates a self-signed certificate. The self-signed certificate is used for administrative access and for communication within the distributed deployment (HTTPS) as well as for user authentication (EAP). In a live system, use a CA certificate instead of a self-signed certificate.

when it says user eap authentication which users does it refer to is it ISE Admins ??

also Ive inherited this deployment whats the downside of using self signed for this please.?

Thanks

[Rob Ingram]

@benolyndav the EAP certificate is the certificate presented to the endpoints/clients devices when authenticating using dot1x. Generally the EAP certificate issue by an Internal CA (such as from Windows AD PKI), which is then trusted by domain computers. Using a self signed certificate for EAP means the endpoints would not trust this certificate and would cause authentication issues.

[benolyndav]

Hi

So would the PSN Nodes have different certs than the PAN node. ?? e.g for EAP

Thanks

[Rob Ingram]

@benolyndav admin certs would be different for each node, the EAP cert can be different or the same cert (multi domain cert or wildcard).

[MHM Cisco World]

There is many certificate 

Some not all

1- admin use to access gui of ISE

2- portals cert use for web auth

3- eap cert  use for radius EAP-TLS and other EAP auth 

When you use CSR there is field you can select for which this cert. Will use.

So dont confuse admin is different than portal.

MHM

[MHM Cisco World]

Additional to @Rob Ingram link

Check this link also

https://community.cisco.com/t5/security-knowledge-base/how-to-implement-digital-certificates-in-ise/ta-p/3630897

MHM