NET::ERR_CERT_REVOKED CISCO ISE 2.7

[ROradu]

Hello,

I am unable to access the GUI anymore because de SSL cert was revoked by mistake. 

Your connection is not private
Attackers might be trying to steal your information from 10.221.66.17 (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_REVOKED

Can HTTP be enabled in order to change it via GUI?

Can be changed in CLI? (or installed any "safe-mode self signed cert"?)

Are there any other options?

Cisco Identity Services Engine Version : 2.7.0.356

[ahollifield]

You cannot enable HTTP to the admin GUI of ISE.  TAC is probably your best bet here.  The CLI does not support any certificate operations.  If you are on 3.1, you may be able to use some of the APIs for this though.

[Marcelo Morais]

Hi @ROradu ,

 1st, please take a look at: CSCvs02589 NET::ERR_CERT_REVOKED in Chrome on macOS 10.15 due to the 5-year self-signed server cert.

Conditions:
 macOS 10.15 (Catalina)
 Using Google Chrome or Microsoft Edge to access ISE web UI
 ISE server certificate is valid longer than 825 days
Workaround:
 Re-generate the ISE server certificate with a shorter validity period.

2nd, try to bypasses certificate-based authentication via ISE in Safe Mode:

ise/admin# application stop ise
ise/admin# application start ise safe
 % Warning : ISE RUNNING IN SAFE MODE. IP ACCESS RESTRICTIONS ARE RELAXED
 % AND CERTIFICATE BASED AUTHENTICATION IS BYPASSED.
 ...

Hope this helps !!!

[thomas · Accepted solution]

You should still be able to access the GUI via HTTPS even if the certificate is bad, just like you can have your browser trust a self-signed certiificate.

Try accessing ISE via IP address rather than the DNS name and accept