ISE: how to extend the due of certification

[naoki_Japan]

I found that there are 4 self-signed certifications on the ISE by default.

One of them is for SAML, only which of the due can be extended by checking the " Renewal Period" box and enter the TTL.

However, as for the other certifications, I can not check the box and not extend the due.

moreover, for certification of ISE Messaging service, I notice that I cannot create it on the panel >Generate Self Signed Certificate

please tell me how can I handle this problem.

should I create new certification ?

how can I extend the due of certification of  ISE Messaging service and others?

[ComputerRick · Accepted solution]

For the ISE Messaging Service, it is generated from the Internal CA service that runs on ISE.

The Messaging cert is not extended, and for this case, I would suggest regenerating the ISE Root CA.

Go to Certificates, then Certificate Signing Requests, and Generate CSR.  There will be a pull-down menu, select ISE Root CA from that and then the Generate button.  The pull-down will also have the ISE Messaging cert, among others.  If your messaging cert is about to expire, it's likely expiring on more than one node and a new root would be a better method.

HTH.

[Marvin Rhoads · Accepted solution]

In addition to what @ComputerRick correctly noted, you must first have the Internal Certificate Authority (CA) enabled for the ISE Root CA option to be available as an option.

Administration > System > Certificates > Certificate Authority > Internal CA settings > Enable Certificate Authority

[naoki_Japan]

Your advice solved the problem I had.
THX!!!

[naoki_Japan]

As you advised, I set up internal CA and got it!!!

thank you for support!! appreciate it!!