Renewing HTTPS Certificate in Cisco ISE

[Michael Trip]

Hello,

A few months ago a renewed our eap certificate. Now i have to renew the HTTPS certificate. ISE says there will be a "significant" downtime when renewing the certificate.

What is this downtime exactly? Can't users authenticatie through EAP / Radius?  Or is it only the web interface? I can't find any documentation on this matter.

Kind regards,

Michael Trip

[Jatin Katyal · Accepted solution]

The only downtime you can expect while renewing the HTTPS certificate is:

1. For HTTPS protocol changes, a restart of the ISE services is required, which creates a few minutes of downtime. You will not be able to access the GUI for round 10 - 15 minutes.

2. If you use self-signed certificates in a distributed deployment, the primary self-signed certificate must be installed into the trusted certificate store of the secondary ISE server.  Likewise, the secondary self-signed certificate must be installed into the trusted certificate store of the primary ISE server. This allows the ISE servers to mutually authenticate each other.  Without this, the deployment might break. If you renew certificates from a third-party CA, verify whether the root certificate chain has changed and update the trusted certificate store in the ISE accordingly.

Here is document where same steps are documented. I've highlighted for your convenience.

Rgds,

Jatin

~ Do rate helpful posts.