Hi all,
I have just rolled out ISE 2.0 in a distributed deployment with 2 nodes for a guest wireless network utilising the Sponsor Portal. I am about to generate a CSR for the client's public CA to sign and I want to use a single certificate for both nodes, however the client does not permit wildcard certificates. I believe ISE 2.0 requires a wildcard entry in the SAN field to deploy to both nodes, otherwise two CSRs are required. Is there any way around this? Two certs with multiple SAN entries can get pretty expensive.
Can I use a tool like OpenSSL to generate a single CSR and put both FQDNs in the SAN field? Will ISE allow me to import the one certificate to both nodes and assign to the 'Portal' function?
The environment contains the following:
ISE1.localdomain (primary admin, secondary monitoring, PSN)
ISE2.localdomain (secondary admin, primary monitoring, PSN)
guestportal.publicdomain (guest portal URL that clients are redirected to)
.
Is the CSR below correct for this deployment?
CN=ISE1.localdomain
SAN
DNS = ISE1.localdomain
DNS = ISE2.localdomain
DNS = guestportal.publicdomain
.
Unfortunately I need to get this right before the CSR is sent to the CA, so if somebody could help confirm all this it would be greatly appreciated!
-Brett
