Portals presenting wrong cert

[Madura Malwatte]

I have imported a wildcard certificate signed by our enterprise root CA into the system certificates list in ISE and its using this wildcard for the default portal certificate group, eap, admin, etc.

The default portal certificate group has the all the default portals and the new portals I have created listed under it. 

However when I access a portal, lets say mydevices portal, I am presented with a self signed certificate issued to and by the PSN, instead of the cert chain that was issued by the root CA at the top level which is the wildcard system certificate.

In Device Portal Management > My Devices > Portal Settings, the Certificate group tag is set for "default portal certificate group".  

Am I missing something?

[ajc]

If you are NOT running PSN persona on that node where you installed the wildcard enterprise signed CA, then you will get that error. The same wildcard cert must be copied into each PSN. I do not know what ISE version are you running, what is your deployment, etc

[Madura Malwatte · Accepted solution]

Thanks. This is a distributed deployment, the nodes were already registered so when I updated the cert on the PAN and it was automatically pushed to the other nodes. But looks like this process may not have worked correctly, even though the GUI was showing wildcard cert for portals, admin, etc, the nodes were using their self-signed cert. I took everything off the wildcard, re-applied and re-synced manually which did the trick.

[Jason Kunst]

The admin portal is using the same certificate so it should have already restarted once. This certificate thing is tricky, so another restart might help or reloading the O/S.

[Madura Malwatte]

Hi Jason, thanks for pointing me in the right direction. I had previously updated the wildcard cert and imported again into the PAN, after deleting the old wildcard from all the nodes. Since my other nodes were already registered at that point, the wildcard cert showed up automatically on the other nodes (view from system certificates tab) and the usage was correct. 

What I did now was move the portals, admin, eap, etc to the self signed cert on all the nodes, then moved them back over to the wildcard cert and issued a re-sync on those nodes. This has fixed the issue. I'm getting the correct cert presented on the portals by the PSN.