How to Install a Certificate from an Internal CA on ISE

Note: This assumes that your clients are already configured to trust the Internal CA as a Trusted Root Authority.  This is usually handled by a GPO.

Download the CA root certificate
Navigate to https://certserver/certsrv
Click Download a CA certificate, certificate chain, or CRL
Highlight the CA certificate and click Download CA certificate
Save the file to your hard drive.


Install the CA root certificate
Log into ISE
Click Administration > System > Certificates > Certificates Store > Import
Select the file you've downloaded earlier
Enter a Friendly Name
Highlight Trust for client authentication or Secure Syslog services
Click Submit

Create a Certificate Signing Request
Click Administration > System > Certificates > Local Certificates > Add
Click Generate Certificate Signing Request
Set Certificate Subject to FQDN
Add Subject Alternative Names
Set Key Length to 2048 and Digest to Sign with to SHA-256
Click Submit
Open Administration > System > Certificates > Certificate Signing Requests
Select the CSR and click Export
Save the file to your hard drive

Request a Certificate from the CA using the CSR
Navigate to https://certserver/certsrv
Click Request a Certificate
Click Advanced Certificate Request
Click the Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file
Copy the contents of the CSR (.pem file) and Paste into the "Base-64-encoded certificate request" window
Under Certificate Template, choose Web Server
Click Submit
Hightlight DER encoded and click Download Certificate
Save the certificate to your hard drive

Install the Certificate in ISE
Log into ISE
Click Administration > System > Certificates > Local Certificates > Add
Click Bind CA signed Certificate
Browse to the certificate file you have just saved.
Enter a Friendly name
Select EAP and HTTP under Protocol
*WARNING* Clicking Submit will Reboot ISE
Click Submit