6.5.15 Cisco ISE

Configure OpenAPI, node access, certificate roles, and trusted CA certificates

CertKit provides Cisco ISE templates for Portal and EAP Authentication system certificates. Both deploy to every Connected node in a standalone or multi-node ISE deployment.

Requirements

  • Cisco ISE 3.1 or later.
  • Enable OpenAPI under Administration > System > Settings > API Settings.
  • Use an ERS Admin or Super Admin account.
  • The agent host must reach the Primary Admin Node or API Gateway and every node FQDN or IP on TCP 443.

Portal template

The Cisco ISE: Portal template assigns the Portal role and a portal group tag. The tag must already exist in ISE. The default is Default Portal Certificate Group.

If the certificate is already present, the template adds a missing Portal role or tag while preserving existing roles. It does not modify certificates holding the Admin, SAML, or IMS role.

EAP Authentication template

Only one system certificate can hold the EAP Authentication role on a node. The template uses ISE’s role-transfer options to move EAP Authentication from the prior certificate to the renewal. Other certificate roles are preserved; certificates holding the Admin, SAML, or IMS role are not modified.

Trusted CA import and Let’s Encrypt

The templates attempt to import intermediate CA certificates through OpenAPI. Some ISE versions reject CA subjects containing apostrophes, including Let's Encrypt, with “Security Check Failed.” When this occurs, the deployment stops and prints the CA certificate and manual import instructions.

Import the missing intermediate and root CA certificates under ISE Trusted Certificates, and enable Trust for authentication within ISE. Use the CA certificates from the actual issued chain. For Let’s Encrypt, obtain current CA files from its Chains of Trust page; CA hierarchies can change, so do not assume a fixed intermediate name.

After the one-time trust import, rerun the deployment.

Common problems

  • Node deployment fails: confirm the agent can resolve and reach every Connected node, not only the PAN.
  • Portal tag error: create the named portal group tag or correct the template setting.
  • Security Check Failed: manually add the CA certificate printed in the deployment output and the remaining root chain, then retry.
  • Authorization failure: confirm OpenAPI is enabled and the account has ERS Admin or Super Admin privileges.