Cisco ISE

Identity and remote access

Installs system certificates with selected roles on one Cisco ISE node and checks the certificate’s SHA-256.

What happens

The appliance connects to Cisco ISE through ISE Open API on port 443.
Discovery finds nodes, system certificates and their roles. The package imports the certificate and key on one node and adds the chain to the trusted store.
Selected roles are bound: Admin, EAP, RADIUS DTLS, pxGrid, ISE Messaging Service, SAML or Portal. An Admin import restarts the node’s application server.
Verification requires SHA-256 and roles read back; for Admin the package waits for the node to serve the new certificate.

Connection: The package runs on the appliance, which connects over HTTPS to ISE Open API, port 443. No agent is installed.
Service ports: 443
You need: Enable Open API and use an ISE administrator. Select a node and roles from discovery. The password must contain 12-256 ASCII characters: A-Z, a-z, 0-9 or _.:+=,/-.
Platform: Cisco ISE 3.1, 3.2, 3.3 and 3.5 with Open API
Actions: Discovery, Installation, Verification, Rollback
Packages: cisco-ise-api
Note: Rollback returns roles to previous certificates only while every affected certificate remains as deployment left it. No certificates are deleted; an already installed identity leaves nothing to roll back.
An unresolved import response can mean the certificate was installed. The package stops for administrative resolution and does not pass the task to another relay. Roles other than Admin are verified through API readback.
The destination address must reach the selected node because ISE imports on the node receiving the call. The Admin role requires ISE_ALLOW_ADMIN_RESTART=true to allow the application server restart. The Portal role requires ISE_PORTAL_GROUP_TAG.