- Introduction:
- Adding a Certificate:
- Editing a Certificate:
- Exporting Certificate:
- Deleting Certificate:
- Reference:
Introduction:
This document descibes the method to add,delete,edit certificate in ISE which is providing functionality of radius server.
Adding a Certificate:
- Step 1 Choose Administration > System > Certificates.
- Step 2 From the Certificate Operations navigation pane on the left, click Certificate Authority Certificates.
The Certificate Authority Certificates page appears.
- Step 3 Click Add.
- Step 4 Click Browse to choose the certificate authority certificate from the file system that is running the client browser.
- Step 5 Check the Trust for client with EAP-TLS check box if you want to use this certificate in the trust list for EAP-TLS protocols.
- Step 6 Add an optional description.
- Step 7 Click Submit to save the certificate authority certificate.
When you add a certificate to your primary ISE node, you need to restart the secondary nodes connected to your primary ISE node. To restart the secondary nodes, use the following commands (CLI):
application stop ise
application start ise
Editing a Certificate:
- Step 1 Choose Administration > System > Certificates.
- Step 2 From the Certificate Operations navigation pane on the left, click Certificate Authority Certificates.
The Certificate Authority Certificates page appears.
- Step 3 Check the check box next to the certificate that you want to edit and click Edit.
You can edit the following:
- Friendly Name
- Description
- Usage
- Certificate Revocation List Configuration
- Step 4 Enter a friendly name to easily identify this certificate.
- Step 5 Enter an optional description.
- Step 6 Check the Trust for client with EAP-TLS check box if you want to use this certificate in the trust list for EAP-TLS protocols.
- Step 7 In the Certificate Revocation List Configuration area, do the following:
- Check the Download CRL check box for the ISE to download a CRL.
- Enter the URL to download the CRL from a CA in the URL Distribution text box. This field will be automatically populated if it is specified in the certificate authority certificate. The URL must begin with "http" or "https."The CRL can be downloaded automatically or periodically.
- You can configure the time interval between downloads in minutes, hours, days, or weeks if you want the CRL to be downloaded automatically before the previous CRL update expires.
- Configure the time interval in minutes, hours, days, or weeks to wait before the ISE tries to download the CRL again.
- If you uncheck the Bypass CRL Verification if CRL is not Received check box, all client requests that use certificates signed by the selected CA will be rejected until ISE receives the CRL file. If you check this check box, the client requests will be accepted before the CRL is received.
- If you uncheck the Ignore CRL that is not yet valid or expired check box, ISE checks the CRL file for the start date in the Effective Date field and the expiration date in the Next Update field. If the CRL is not yet active or has expired, all authentications that use certificates signed by this CA are rejected. If you check this check box, ISE ignores the start date and expiration date and continues to use the not yet active or expired CRL and permits or rejects the EAP-TLS authentications based on the contents of the CRL.
- Step 8 Click Save to save the changes you have made to the certificate authority certificate.
If you edit a certificate authority certificate on your primary ISE node, you must restart the secondary nodes connected to your primary ISE node. To restart the secondary nodes, from the command-line interface (CLI), enter the following commands:
application stop ise
application start ise
Exporting Certificate:
- Step 1 Choose Administration System > Certificates.
- Step 2 From the Certificate Operations navigation pane on the left, click Certificate Authority Certificates.
The Certificate Authority Certificates page appears.
- Step 3 Check the check box next to the certificate that you want to export and click Export.
- Step 4 Save the privacy-enhanced mail file to the file system that is running your client browser.
Deleting Certificate:
- Step 1 Choose Administration > System > Certificates.
- Step 2 From the Certificate Operations navigation pane on the left, click Certificate Authority Certificates.
The Certificate Authority Certificates page appears.
- Step 3 Check the check box next to the certificate that you want to delete and click Delete.
The following message appears.
Are you sure you want to delete?
- Step 4 Click OK to delete the certificate authority certificate.
