Cisco Ise 13 User Guide

•sponsor.ise.company.local
Wildcard Certificate Compatibility
WildcardcertificatesareusuallycreatedwiththewildcardlistedastheCommonName(CN)oftheCertificate
Subject.CiscoISEsupportsthistypeofconstruction.However,notallendpointsupplicantssupportthe
wildcardcharacterintheCertificateSubject.
AllMicrosoftnativesupplicantstested(includingWindowsMobile)donotsupportwildcardcharacterinthe
CertificateSubject.
Youcanuseanothersupplicant,suchasCiscoAnyConnectNetworkAccessManager(NAM)thatmight...

2SubmitittoaCertificateAuthority(CA)
3Obtainthesignedcertificate
4ImporttherelevantrootandintermediateCAcertificatesintotheTrustedCertificatesStore
5BindthesignedcertificatewiththeCSR
View System Certificates
TheSystemCertificatepagelistsallthesystemcertificatesaddedtoCiscoISE.
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseAdministration>System>Certificates>SystemCertificates....

Before You Begin
•Ensurethatyouhavethesystemcertificateandtheprivatekeyfileonthesystemthatisrunningthe
clientbrowser.
•IfthesystemcertificatethatyouimportissignedbyanexternalCA,importtherelevantrootCAand
intermediateCAcertificatesintotheTrustedCertificatesStore(Administration>System>Certificates
>TrustedCertificates).
•CiscoISEdoesnotsupportcertificatesthataresignedwithahashalgorithmgreaterthanSHA-256.
Hence,youmustnotimportaservercertificatethatissignedwithahashalgorithmgreaterthanSHA-256....

Togenerateaself-signedcertificatefromasecondarynode,chooseAdministration>System>Server
Certificate.
Step 2ClickGenerateSelfSignedCertificateandenterthedetailsintheGenerateSelfSignedCertificatepage.
Step 3CheckthecheckboxesintheUsageareabasedontheserviceforwhichyouwanttousethiscertificate.
Step 4ClickSubmittogeneratethecertificate.
Torestartthesecondarynodes,fromtheCLI,enterthefollowingcommandsinthegivenorder:
a)applicationstopise
b)applicationstartise
Edit a System Certificate...

Procedure
Step 1ChooseAdministration>System>Certificates>SystemCertificates.
Step 2CheckthecheckboxnexttothecertificatethatyouwanttoexportandthenclickExport.
Step 3Choosewhethertoexportonlythecertificate,orthecertificateanditsassociatedprivatekey.
Wedonotrecommendexportingtheprivatekeyassociatedwithacertificatebecauseitsvaluemay
beexposed.Ifyoumustexportaprivatekey(forexample,whenyouexportawildcardsystem
certificatetobeimportedintotheothernodesforinter-nodecommunication),specifyanencryption...

registeringdevice,andthenforwardstherequesttoanexternalCAortheinternalCiscoISECA,which
issuestheclientcertificate.TheCAsendsthecertificatebacktotheRA,whichreturnsittothedevice.
EachSCEPCAusedbyCiscoISEisdefinedbyaSCEPRAProfile.WhenaSCEPRAProfileiscreated,
twocertificatesareautomaticallyaddedtotheTrustedCertificatesStore:
◦ACAcertificate(aself-signedcertificate)
◦AnRAcertificate(aCertificateRequestAgentcertificate),whichissignedbytheCA....

Thefollowingnameconstraintsarenotsupported:
•IPaddress
•Othername
Whenatrustedcertificatecontainsaconstraintthatisnotsupportedandcertificatethatisbeingverifieddoes
notcontaintheappropriatefield,itisrejectedbecauseCiscoISEcannotverifyunsupportedconstraints.
Thefollowingisanexampleofthenameconstraintsdefinitionwithinthetrustedcertificate:...

Procedure
Step 1ChooseAdministration>System>Certificates>TrustedCertificates.
Step 2Checkthecheckboxnexttothecertificateyouwanttoenableordisable,andclickEdit.
Step 3Changethestatus.
Step 4ClickSave.
Add a Certificate to Trusted Certificates Store
TheCertificateStorepageallowsyoutoaddCAcertificatestoCiscoISE.
Before You Begin
•Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
•Ensurethatthecertificatestorecertificateresidesonthefilesystemofthecomputerwhereyourbrowser...

Procedure
Step 1ChooseAdministration>System>Certificates>TrustedCertificates.
Step 2Checkthecheckboxnexttothecertificatethatyouwanttoedit,andclickEdit.
Step 3Modifytheeditablefieldsasrequired.
Step 4ClickSavetosavethechangesyouhavemadetothecertificatestore.
Export a Certificate from the Trusted Certificates Store
Before You Begin
Toperformthefollowingtask,youmustbeaSuperAdminorSystemAdmin.
Procedure
Step 1ChooseAdministration>System>Certificates>TrustedCertificates..
Step...

IfyoudonotenteraFriendlyName,CiscoISEautopopulatesthisfieldwithaFriendlyNameoftheformat
common-name#issuer#nnnnn,wherennnnnisauniquenumber.Youcaneditthecertificateagaintochange
theFriendlyName.
Step 5ChoosetherootcertificatereturnedbyyourCA.
Step 6Checkthecheckboxesnexttotheservicesforwhichyouwanttousethistrustedcertificatefor.
Step 7Enteradescription.
Step 8ClickSubmit.
What to Do Next
ImporttheintermediateCAcertificatesintotheTrustedCertificatesstore(ifapplicable).
Certificate Chain Import...