Cisco ISE Setup Enterprise Root CA

## Introduction

The purpose of this article is to detail the steps necessary to integrate your newly installed Cisco Identity Service Engine (ISE) server with your domain certificate infrastructure.

This article assumes that you have an Active Directory domain and are using Microsoft's Active Directory Certificate Services(ADCS) Below is a map of my example Layout.

## Steps

1. Cisco ISE - Import the Root CA Certificate
2. Cisco ISE - Generate a Certificate Request
3. Microsoft ADCS - Generate the Certificate
4. Cisco ISE - Import new Certificate
5. Test Functionality

## Detailed Steps

### Import the Root CA Certificate

1. Log into Cisco ISE

2. Go to **Administration > Certificates**

3. Click on **Trusted Certificates** on the left-hand side

4. Select Import near the top of the page

5. In the new window that opens click on Choose File

6. Fill in friendly name and select the appropriate boxes in the **Trusted For** Section

7. Enter A Description and Click Submit

8. Click ok in the pop-up window

When you are returned to the trusted certificate page scroll down and ensure that your newly imported certificate is there

### Cisco ISE - Generate a Certificate Request

1. Login to your Cisco ISE Server

2. Go to **Administration** > **Certificates**

3. Click on **Certificate Signing Requests** in the Left-hand menu

4. In this new window click on the **Generate Certificate Signing Requests** button

5. Ensure the **Allow Wildcard Certificates** is checked

6. Enter the following information:

a. Common Name: usually the FQDN of the server

b. Organizational Unit: This is organizational Dependendant

c. Organization: This is organizational Dependendant

d. City

e. State

f. Country

7. Subject Alternative Name (SAN) this is the alternative methods to reach the ISE server Iike the Ip address or if you use a c name record in windows DNS.

8. Click Submit

### Microsoft ADCS - Generate the Certificate

1. Login to the Certificate Server webpage with the IP of the server /certsrv/ i.e. (**HTTP://10.10.10.2/certsrv/**)

2. When Prompted Login with your domain admin credentials

3. At the landing page click on **request a certificate**

4. in the next page click on the **advanced certificate request**  link

5. Open the CSR request that you downloaded from the Cisco ISE server with a text editor (like Notepad ++). This file has a **.pem** file extension.

6. Once you have the file open select and copy all of the text inside of the CSR.

7. Go back to the AD CS Webpage and paste in the text from the ISE CSR

8. Set the Certificate Template to "Web Server"

9. Click Submit

10. you will be prompted to download the certificate click the download certificate

11. I suggest that you rename the certificate from Certnew.cer to something more descriptive namely ISEServer.cer

### Cisco ISE - Import new Certificate

1. Log into Cisco ISE

2. Go Back to **Administration > Certificates**

3. Click on Certificate Signing Requests in the menu on the left-hand side.

4. Select the box next to the CSR you generated earlier and select the Bind Certificate Button

5. In the new window that appears click on the Choose file button and a open file dialog select the file that you obtained from the CA server earlier.

6. Once you have the file selected Enter a friendly name for the certificate and click submit

### Test Functionality

After the ISE server Reloads itself to use the new certificates browse the the page and you should no longer receive the alert that the session couldn't be trusted and instead (depending on your browser) you should see a lock on the side of the web address

Insert Pictures