ISE system certificates renewal

[Da ICS16]

Dear Cisco community,

We are planning to ISE renewal certificates "System Certificates".

There are 3 Nodes of deployment nodes ( PAN, 2nd Node, pxGrid node ).

Could you share process to renewal it?

Remark:

- ISE "Trusted Certificates" is not expired.

- ISE integrate with AD

Thanks,

[ammahend]

call TAC and get their help if you have never done it before.

basically you have 2 ways and depends on how you issue certs, some people do it individually per node, some people do a single cert with multiple SAN (subject alternative name) which is more common for small deployment.

Basically you will generate a new CSR, add SAN fields with fqdn of each nodes (up to 5 allowed per cert), export the CSR, get is signed by the same CA for which you have trusted certificate, bind the signed certificate with CSR, then export the certificate with private key and import in rest of the node one by one. 

more details here

[Da ICS16]

Hello @ammahend,

Thanks for commend.

[Da ICS16]

Hello @ammahend ,

Based on your experience, is there any impact to endpoint PCs and MAB or not if perform renewal only ISE "System Certificates" ?

thanks for your supporting.