Automated SSL certificate renewal for Cisco ISE

ISE won't move a certificate's roles to its renewal on its own. CertKit will.

Every node in a Cisco Identity Services Engine deployment holds its own system certificates, and each one carries usage roles. Portal, with a portal group tag, secures the guest and sponsor portals. EAP Authentication is the certificate 802.1X clients check before they join the network. A renewed certificate does nothing until someone imports it on every node and gives it the role. Every 47 days.

CertKit issues and renews the certificate centrally, then the CertKit Agent imports it on each ISE node through the OpenAPI and moves the role from the old certificate to the new one.

Start free trial Watch demo

Built for Cisco ISE

Pre-built templates for the Portal and EAP Authentication roles ship in your CertKit account. No scripting required.

On every renewal, the agent asks ISE for its Connected nodes, adds the CA chain to Trusted Certificates, and imports the certificate on each node with the role you chose. For a renewal with the same subject, ISE's role-transfer options take the role off the previous certificate in the same step. A standalone node and a multi-node deployment use the same template.

The templates never assign the Admin role, which is the role that restarts ISE application services on a node. Other roles a certificate already holds are left as they are.

How to install a system certificate on Cisco ISE

The manual process, if you want to do it yourself:

Get the renewed certificate. Generate a certificate signing request under Certificate Management → Certificate Signing Requests and bind the signed certificate when it comes back, or bring your own certificate and private key. A wildcard certificate can cover the portal and EAP identities of every node.
Trust the CA chain. Under Administration → System → Certificates → Certificate Management → Trusted Certificates, import each intermediate and the root, and check Trust for authentication within ISE. Skip this and the import fails with "Failed to verify certificate path".
Import the system certificate. Under Administration → System → Certificates → Certificate Management → System Certificates, choose Import, select the node, and upload the certificate file and private key file. Check Allow Wildcard Certificates if it's a wildcard.
Pick the usage role. Check Portal and choose the portal group tag, usually Default Portal Certificate Group, or check EAP Authentication. Only one certificate on a node can hold EAP Authentication, so the renewal has to take the role from the old one. Leave Admin alone unless you want the node's services to restart.
Repeat on every node. System certificates belong to a single node, so each node needs its own import. A wildcard imported on the Primary PAN replicates to the others, and a Certificate Replication Failed alarm means one of them missed it.

Every one of these steps is manual, and ISE won't repeat any of them when the certificate renews. With lifetimes shrinking to 47 days, that's twelve times a year, on every node. Miss the EAP certificate and the logs fill with "12321 PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate" while laptops and phones fall off the Wi-Fi.

At 47 days, automation is the only sustainable way to run Cisco ISE certificates. Here's how CertKit does it.

CertKit has been a fantastic solution for automating our environment’s SSL/TLS certificates. With a single pane of glass for centralized management, visibility, and monitoring and the highly customizable interface for granular control over individual systems, we have found great value in reducing the time and complexity of managing an ad-hoc ACME solution for individual certificate automation.

Seth Allums, Lead Systems and Information Security Engineer, Clackamas Community College

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │CertKit Agent├──┼────►│  Issue & Renew   │◄──►│             │
│  └──┬────┬─────┘  │     │   Certificates   │    │             │
│     │    │OpenAPI │     │                ┌───┐  └─────────────┘
│     │    │ :443   │     └────────────────│DNS│
│     ▼    ▼        │                      └───┘
│ ┌──────────────┐  │
│ │ ISE nodes    │  │
│ │ [x] Trusted  │  │
│ │ [x] Imported │  │
│ │ [x] Role set │  │
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally using delegated DNS validation. You create a one-time CNAME record, and CertKit handles every ACME challenge after that.

The CertKit Agent runs on a Windows server inside your network. It pulls each renewal from CertKit over outbound HTTPS, then calls the ISE OpenAPI on the Primary PAN and on each node over port 443. CertKit never connects into your network. ISE never talks to CertKit, never runs ACME, and never holds DNS credentials.

Two roles on every ISE node

CertKit ships a separate template for each role, so a node can carry one certificate for its portals and another for 802.1X. Both reach every Connected node in the deployment.

Portal Guest and sponsor portals, matched by portal group tag EAP Authentication Server certificate for PEAP and EAP-TLS on Wi-Fi and wired 802.1X

What CertKit handles

Issue and renew centrally. The one-time CNAME covers every renewal challenge. ISE has no ACME configuration and no DNS credentials.
Find every node. The agent reads the deployment's node list through the OpenAPI and targets every Connected node, so a node you add later is covered on the next renewal.
Trust the chain once. Intermediates go into Trusted Certificates with Trust for authentication within ISE and nothing else, so a public CA is never trusted for client authentication. CAs already in the store are skipped.
Import on each node with the right role. Each node gets the certificate with Portal and your portal group tag, or with EAP Authentication. A wildcard is imported on the Primary PAN, and the agent waits for ISE to replicate it to the other nodes.
Add a missing role without stripping others. If the certificate is already on a node, the agent adds the missing role and keeps the ones it has. Certificates holding Admin, SAML, or ISE Messaging Service are never changed automatically.
Remove old certificates. Previous CertKit certificates are deleted once ISE reports them as Not in use. Anything still in use stays until a later run.
Alert on failure. A node that fails doesn't stop the others, and the run reports which node failed and why.
Audit every change. Every issuance, renewal, and deployment is logged. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit.
Turn on the OpenAPI. On ISE 3.1 or later, enable it under Administration → System → Settings → API Settings, and use an account with ERS Admin or Super Admin.
Install the CertKit Agent. One command on a Windows host that can reach the Primary PAN and every node on port 443.
Add the Cisco ISE deployment script. Choose the Portal or EAP Authentication template, then enter the PAN address, the credentials, and the portal group tag for Portal.

See the full architecture →

Cisco ISE deployment requirements and troubleshooting →

Why some chains need one manual import

Some ISE versions refuse any CA certificate whose subject contains an apostrophe when it arrives through the API. Let's Encrypt is the common case. The OpenAPI answers "Security Check Failed", while the same certificate imports through the Admin UI without complaint. A script that logs the error and moves on fails later, at the import on every node.

CertKit checks the path to a trusted root before it touches any node. When ISE rejects a CA, the deployment stops and prints that certificate with the steps to import it under Trusted Certificates. Import that CA once, plus its root if ISE doesn't already trust it, and every renewal after that runs on its own.

Cisco ISE is just one part of your network access control

Most networks check identity in more than one place: policy managers like Aruba ClearPass, Microsoft's Network Policy Server answering RADIUS in Windows shops, and firewalls like Cisco Firepower at the edge. CertKit automates all of it from one account.

See all integrations

Start automating Cisco ISE certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing