ISE v3.1 upgrade fails due to non-existing certificate has expired

[dal]

Hi.

In the ISE dashboard, I'm slapped in the face every day with Alarms like these:

Certificate expired.

When looking at this, it says:

Trust certificate 'Certificate Services OCSP Responder - ISE-RvN#00005' expired on Sat; 2 Nov 2019 : Server=ISE
Trust certificate 'Certificate Services Endpoint Sub CA - ISE-RvN#00003' expired on Sat; 2 Nov 2019 : Server=ISE

Problem is, those certificates are nowhere to be found in the system.

Both of them have been replaced several times, and the current ones look like this:

Certificate Services OCSP Responder - ISE#00018
Certificate Services Endpoint Sub CA - ISE#00015

So how to get rid of this error.

The problem is that I cannot upgrade to v3.1 before this is resolved.

The thing is, I don't even use the Certificate Authority part of ISE

Thanks

[Greg Gibbs · Accepted solution]

If you don't see the certificates in the GUI, they are likely orphaned in the database somehow. You'll need to call TAC to help search for and delete them directly from the database.