Cisco ISE¶

1. In the Certificate Manager - SaaS toolbar, click Machines.
2. Click the more options button at the right end of the Cisco ISE machine's row, and then select Provision.

3. From the Search a certificate by name, expiration, or fingerprint field, begin typing the certificate name you want to provision. Click the certificate when it appears in the list.

4. Under Certificate Location, in ISE Node Hostname, enter the hostname of the Cisco ISE node where you want to install the certificate. Enter it as it appears in the deployment's node list. The match isn't case-sensitive.

5. Leave Certificate ID empty. Cisco ISE assigns the ID when it imports the certificate, and Certificate Manager - SaaS fills it in and uses it to find the certificate on later renewals and usage changes.

6. (Optional) In Friendly Name, enter a display name for the certificate on the Cisco ISE node. If you leave it empty, Certificate Manager - SaaS derives a name from the certificate.

7. Under Certificate Usage, for Usage, choose the Cisco ISE service to assign the certificate to:

   • Admin
   • EAP Authentication
   • RADIUS DTLS
   • Portal
   • pxGrid
   • SAML
   • ISE Messaging Service
   • Not in use: installs the certificate without assigning it to a service. This is the default.

   Warning

   Assigning Admin restarts the application server on the node. If the node is the Primary Policy Administration Node, every node in the deployment restarts. Management access to the affected nodes is unavailable until the restart finishes.

   Note

   EAP Authentication, RADIUS DTLS, and Portal each allow only one certificate per node. Assigning one of them moves that usage off the certificate that currently holds it, which drops in-progress sessions for that service.

   Note

   SAML can't share a certificate with any other usage. Assigning SAML removes the certificate's other usages, and you can't add another usage to a certificate that holds SAML.

8. If you chose Portal, in Portal Group Tag, enter the group tag that the Cisco ISE portals use to find their certificate. The default is Default Portal Certificate Group.

   Note

   If the certificate already has a different portal group tag, Cisco ISE might keep the existing tag instead of the one you enter. Provisioning still succeeds, so check the certificate's group tag in Cisco ISE afterward.

9. To save without pushing the certificate, disable Push certificate on save.

10. Click Save.

    Tip

    You can schedule your provisions daily, weekly, or monthly. See Set up a machine provisioning schedule.

After you save, Certificate Manager - SaaS imports the certificate's issuing chain into the deployment's trusted certificate store, installs the certificate on the node you specified, and assigns it to the usage you chose. An installation appears on the Installations tab.