Trusted Certificates | Default self-signed server certificate

[Xividar]

Hi Guys,

How do we renew our ISE Trusted Default Self-Signed Cert?

Thank you.

[Mike.Cifelli · Accepted solution]

To re-gen self signed certs go to: Administration->System->Certificates->Certificate Management->System Certificates->'Generate Self Signed Certificate'

HTH!

[Xividar]

Hi Mike,

Are you saying that once the default self-signed ISE Root Cert expires, we need to move services off of it? Is there no way to renew it?

[Greg Gibbs]

The 'Default self-signed server certificate' in the Trusted Certificates store is simply a copy of the same cert in the System Certificates store. Depending on the version of ISE you are using, you should be able to edit the cert in the System Certificates store and use the Renew Self Signed Certificate option at the bottom to extend the expiration date. The changes should also be reflected in the Trusted Certificates store.

[engineer467]

Dear Greg,

Other than extending the renewal period, what else needs to be done if we are using the self signed cert for PEAP (EAP with MSCHAPv2) authentication?

Please help.

Thank you.

[Greg Gibbs · Accepted solution]

The self-signed certificates should only be bound to services that are not actually in use in your environment (pxGrid, RADIUS DTLS, SAML, etc). I would only use the renew self signed certificate option for those certificates. The other option would be to generate new self-signed certs for these unused services upon expiry of the old ones.

Self-signed certificates should never be used for services like EAP. This is NOT recommended and would require re-enrollment of all EAP clients upon any change to the self-signed certificates.

Ideally, an Enterprise CA should sign the ISE and client EAP certificates. Failing that (or for clients that are not managed by your organisation), Public CA signed certificates should be used.

[ryreyes]

Hi Greg, 

Just a question regarding this renewal of the default self-signed certificate. I have 2 ISE in HA and I successfully do the renewal/extension of the default self signed certificate of the primary ISE, however when I do the renewal/extension on the secondary node after I save it and the services restarts the default self signed certificate of the secondary ISE was not renewed. Do I need to switchover the role first for the renewal of the secondary node certificate to take effect? I can't see any documentation regarding this so I appreciate any inputs. Thank you.

[thomas]

You should NEVER renew a self-signed certificate.

Use a public-CA signed certificate or enterprise CA.