What is the best practice to use Public wild Certs and Inside Windows CA

[ccie14007]

We just bought wild public SSL certificates. we also have windows server CA in our network.

Just want to ask what is the best practice for

Admin:   Internal CA, or Windows CA or Public Wildcard CA?

EAP:  Internal CA, or Windows CA or Public Wildcard CA?

Portal:  Guest, BYOD etc...   Internal CA, or Windows CA or Public Wildcard CA?

I think

Portal: should use Public Wildcard CA.

Admin:  ISE internal CA is ok to build Cluster. 

EAP:  Windows Server CA.

Thanks.

[Rob Ingram]

Hi,

I personally would usually use a certificate issued from the Windows CA for Admin, but Internal CA will obviously work.

I would use a universal certificate for the EAP certificate, create 1 EAP certificate, define a CN and SAN entries for each PSN. Export and import that same certificate onto all PSNs.

There is a cisco live presentation that explains more about this.

HTH

[ajc]

I would suggest you to use the same portal certificate as admin because I hit a bug when I had internal CA cert for admin and Public cert for portals.

[ccie14007]

Thanks all,

do you mean to use the wildcard public cert for all Admin, EAP and Portal? I am confused.

by the way, say my company has AD domain,  company.local.      Then for the new ISE server, what domain name should use?  ise.company.local  or ise.company.com? which is better practice?

if i use ise.company.com,  can is still join the company.local domain?

[Rob Ingram]

Checkout Cisco Live BRKSEC-3697 for more information on certificates with ISE https://clnv.s3.amazonaws.com/2016/eur/pdf/BRKSEC-3697.pdf

I'd personally keep the certificate roles separate.

ISE needs a registered DNS entry it can be in any domain, as long as the fqdn is resolvable. If you register it as ise.company.com yes you can still join it to the company.local domain (by creating an external identity source).

HTH

[ajc]

Not sure what version you are planning to run. In any case I was referring to a bug present on 2.2 patch 4 that affected the sponsor and guest portals (not eap authc). (however I think Cisco released a fix for this issue, need to review my notes).

I have an Entrust certificate for admin &  portals + another Internal CA certificate (wildcard cert) for EAP (installed on owned devices).