ISE OCSP Responder Certificate expiring

[colossus1611]

Hello,

We have a couple of OCSP responder certificates expiring after 60 days. When I check the 'Issued by' column it has the name of one of the other node on it, which is the PAN.

However, I am at a loss about how do I go further to renew it. There seems to be no basic documentation to cover this, but I am sure it is quite simple.

How do I go about renewing it?

Friendly Name Status Trusted For Issued To Issued By Valid From Expiration Date
Certificate Services OCSP Responder - ISE01#00016 Enabled Endpoints,Infrastructure Certificate Services OCSP Responder - ISE01 Certificate Services Root CA - ISE02 Sun, 25 Sep 2016 Sun, 26 Sep 2021
Certificate Services Endpoint Sub CA - ISE01#00017 Enabled Infrastructure,Endpoints Certificate Services Endpoint Sub CA - ISE01 Certificate Services Root CA - ISE02 Sun, 25 Sep 2016 Sun, 26 Sep 2021

[Arne Bier · Accepted solution]

Hi @colossus1611 

It's kind of hidden

[colossus1611]

Hi @Arne Bier ,

Thank you! I didn't notice your response and was wondering how to go about this. So basically this will renew it same as self-signed certificates it seems.

I will give it a go sometime today. Correct me if I am wrong but I think business hours should be fine as it shouldn't cause any disruption by the look of it.

[Arne Bier]

It won't cause any outage - the cert's private key is retained, and all that happens is that the new cert has a new start and end date and a new signature (hash). Serial number should also remain as is, as far as I know. 

**Correction: The Serial number is different - this implies that the certificate is actually regenerated. But it's pretty quick - should be done in less than a minute.

[colossus1611]

Hi @Arne Bier ,

Thanks again. I did go through the renewal process which seems to be just a single click with no selection of nodes required. It's been about an hour now and the certificates are still displaying an old expiry date, though it did suggest it may take some time at time of renewal.

Interesting that it did not ask for a node name at all and yet all the nodes currently have a different OCSP expiry date.

I might have to do this again - don't think the renewal will kick in now, given that it has already been more than an hour of wait.

[ivan_abibe]

Did they eventually renew? I also did the same and it's been a while not sure how long we are supposed to wait