Cisco Community
English
Register
Community will be in Read-only Mode from April 11 at 11:00 PM PT to Monday April 12 at 9:00 PM PT - READ DETAILS HERE
Register
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

312
Views
0
Helpful
1
Replies
Kn1ghtR1d3rOfD00m
Beginner
Beginner
‎03-01-2021 02:07 PM
‎03-01-2021 02:07 PM

ISE root and intermediate cert

Hi folks, 

 

not really sure if this is the right place or not, seeking for your assistance on this matter, 

 

we have a pretty old ISE running 2.0

 

so we have started getting alerts of an intermediate certificate authority:

 

Intermediate certificate authority
Expires : Mon, 12 Apr 2021 12:32:04 PDT

Certificate is going to expire within 60 days

 

Root certificate authority
Expires : Tue, 18 Mar 2036 12:20:18 PDT

Certificate status is good
 
The root, based on the hostname, it is being used for all PSN nodes, 
 
so my question is, do I need to renew this intermediate certificate ? or does not matter? 
in case I need to renew it, is the same process of renewing the root CA? or do I need to renew the root as well? 
can someone give some lights please?
 
a couple of notes I have seen:
 
the root CA is installed in the PC, 
expiration date: Expires : Tue, 18 Mar 2036
 
 
 
 

 

 

0 Helpful
1 REPLY 1
Mike.Cifelli
VIP Advocate VIP Advocate
VIP Advocate
‎03-03-2021 05:20 AM
‎03-03-2021 05:20 AM

First, I strongly recommend upgrading your ISE cluster.  Second, take a peek at the following as it should help: How To Implement Digital Certificates in ISE - Cisco Community

HTH!

0 Helpful
Latest Contents
Email Security - QuoVadis Root Certificate Decommission Migh...
Created by dmccabej on 03-30-2021 09:32 AM
0
0
0
0
Problem Description For all versions of the Email Security Appliance (ESA) and Security Management Appliance (SMA), some Secure Sockets Link (SSL) certificates issued from the QuoVadis root certificate authority (CA) trust chain before 2021-03-31 cannot b... view more
ISE REST APIs Webinar: April 6/7, 2021
Created by thomas on 03-25-2021 07:57 PM
0
0
0
0
  Register Now Automation and programmability for networking and security are increasingly important topics. Every release since ISE 1.2 has included new REST API capabilities to better automate and integrate ISE with the rest of your network, appli... view more
FMT 2.3.4 adding ASA migrations of S2S VPN in public beta
Created by William_Hansch on 03-22-2021 08:00 AM
0
10
0
10
The latest iteration (v2.3.4) of the Cisco Secure Firewall Migration Tool adds public beta support for S2S VPN migrations from ASA: Policy-based (crypto map) Pre-Shared key authentication type VPN configuration to Firepower Management Center VP... view more
What's New for Cisco Defense Orchestrator (CDO)
Created by Andrew Mallio on 03-22-2021 04:40 AM
1
40
1
40
Cisco Defense Orchestrator (CDO) is a cloud-based, multi-device manager that manages security products like Adaptive Security Appliance (ASA), Firepower Threat Defense next-generation firewall, and Meraki devices, to name a few.  We make improvement... view more
ISE Data limiting best practices
Created by Jonathan Casillas on 03-18-2021 04:34 PM
0
5
0
5
Intro This document presents the ISE data limiting best practices that can dramatically improve the system performance on ISE. Symptoms Your deployment may be impacted if the alarms tab on ISE shows High load average, high CPU or high memoy usage alarm... view more
Content for Community-Ad