Renewing ISE SSL certificates, wildcard

[jbroderick@holycross.com]

It is time to renew our SSL certificates in ISE.  We are on ISE 3.0.  We use wildcard certificates.  I have a few questions:

1)  If we have already generated our wildcard cert (for multiple products) from our third-party provider, do I need to generate a CSR as indicated in 'Configure Certificate Renewals on ISE'?

2) We previously had to generate a named SAN cert specific to our ise node for the EAP certificate.  I understand that this is no longer necessary and that we can use our wildcard cert, however, we have to be careful with the CN reference.  Can anyone point me to instructions on this.

3)  It was advised in the Video on ISE certifications, dated March 2022, that the services should be on separate certificates.  How does this work with a single wildcard certificate?

Thank you for any advice.

[Rob Ingram]

jbroderick@holycross.com if you already have a wildcard certificate you just need to import into ISE and assign the required service on each node.

Refer to this certificates guide which covers wildcard usage. It's recommended to use a publically signed certificate for the EAP certificate. It's up to you whether you wish to use the same certificate for each service or use separate certificates for each service. Refer to this section on certificate deployment models - https://community.cisco.com/t5/security-knowledge-base/how-to-implement-digital-certificates-in-ise/ta-p/3630897#toc-hId-1417244287

[ahollifield]

Also don't use a wildcard certificate for EAP.  Windows clients will not trust it.

I am generally not a fan of wildcard certificates at all as tends to lead to private key sprawl and exposure.  But this comes down to your individual organization's security policies.  Do those policies allow you to use the same wildcard certificate across multiple services/platforms?  

[ammahend · Accepted solution]

see answers below :
1)  If we have already generated our wildcard cert (for multiple products) from our third-party provider, do I need to generate a CSR as indicated in 'Configure Certificate Renewals on ISE'?

you can use existing as well as generate a new CSR, if you generate CSR on ise itself then offcourse ISE will have its private key, if you generate using OpenSSL or something, you have to import the private key as well, for wildcard, keep the wild card as SAN, not as subject CN,  as some vendors create issue with wildcard as subject CN.

2) We previously had to generate a named SAN cert specific to our ise node for the EAP certificate.  I understand that this is no longer necessary and that we can use our wildcard cert, however, we have to be careful with the CN reference.  Can anyone point me to instructions on this.

you can do eap authentication with wildcard but it should be the subject alternative name not the primary CN. 

3)  It was advised in the Video on ISE certifications, dated March 2022, that the services should be on separate certificates.  How does this work with a single wildcard certificate?

this is totally up to you, it’s not compulsory but is considered best practice, so that certificate compromise only effect limited services. But it comes with management overhead.