ISE Certificate Lifecycle Engineering

Enterprise PKI renewal framework + ACME automation for ISE guest portal

← SECURITY | Portfolio Index

Category

SECURITY

Status

Active

Premise

Certificate lifespans are shrinking from 398 days to 47 days by 2029 (CA/Browser Forum). Manual renewal across an 8-node ISE deployment (PPAN, SPAN, PMNT, SMNT, 4 PSNs) is unsustainable. The project addresses both the immediate manual renewal need and the long-term automation requirement — as two separate, independently deployable workstreams.

Goals

  • Document and standardize the manual wildcard cert renewal (DigiCert/ZeroSSL → ISE)

  • Build ACME automation: Let’s Encrypt + certbot + Ansible → ISE ERS API

  • Deploy dedicated cert management VM with Vault-backed secrets (zero credentials on disk)

  • Produce audience-specific documentation: lead operations guide, team SOP, analyst CSR guide

  • Identify and prevent the wildcard-in-CN trap that breaks Windows 802.1X (Cisco bug CSCuh22029)

Current State

Production — manual renewal documented with 4 assemblers from 26 partials. ACME automation project scaffolded with dedicated VM (certmgr-01) deployed on KVM, DNS forward/reverse configured, architecture diagram complete.

Deliverables

Manual Renewal (ise-annual-cert-renewal)

  • 4 audience-specific assemblers building from 26 shared partials

  • OpenSSL CSR generation with wildcard-safe config (CN ≠ wildcard, SAN = wildcard)

  • 8-step renewal procedure: CSR → verify → submit → verify signed → import → bind → validate → monitor

  • Rollback procedure, maintenance windows, post-renewal 48-hour monitoring baseline

  • Wildcard CN appendix with Cisco bug, Microsoft reference, CAPI2 debugging, ISE error log symptoms

  • Team SOP with ISE GUI screenshots for delegation

ACME Automation (ise-acme-cert-automation)

  • Architecture: certbot (DNS-01 via Cloudflare) → Let’s Encrypt → Ansible (ERS API) → ISE Portal role

  • Dedicated VM: certmgr-01 (Rocky 9, 10.50.1.63, PKI & Secrets block .60-.69)

  • Secrets architecture: Vault AppRole — Cloudflare API token + ISE ERS credentials pulled at runtime

  • Proven ISE OpenAPI cert calls: system-certificate (per node), trusted-certificate (55 certs verified)

  • Let’s Encrypt trust chain pre-validated in ISE trust store (ISRG Root X1, X2, E8)

  • Cisco TME webinar transcript (Charlie Borton) distilled into key takeaways + collapsible full transcript

  • Graphviz architecture diagram (Catppuccin Mocha)

Infrastructure

  • KVM VM deployment: Rocky 9 on kvm-01 (2G RAM, 2 vCPUs, 20G disk, br-mgmt, q35)

  • BIND DNS: forward A record + reverse PTR on bind-01 (master), zone transfer to bind-02

  • Firewall: outbound-only to Let’s Encrypt, Cloudflare API, Vault cluster, ISE OpenAPI/ERS

Technical Depth

Domain Detail

PKI

X.509v3, CSR generation (OpenSSL), wildcard cert constraints, DER/PEM/PKCS encoding, CA chain validation, CRL/OCSP/AIA

ISE API

OpenAPI cert management (system-certificate, trusted-certificate), ERS cert import, Portal role binding, Default Portal Certificate Group

ACME

RFC 8555, DNS-01 challenge, certbot + Cloudflare plugin, 90-day cert lifecycle, cron automation

Secrets

Vault AppRole auth, scoped secret paths, runtime credential injection, post-use shredding

Infrastructure

KVM/libvirt, QEMU q35, BIND9 zone management (forward + reverse), Rocky 9 minimal

Documentation

AsciiDoc modular architecture, attribute substitution in source blocks, multi-audience assemblers from shared partials

Next Steps

  • Install certbot + Cloudflare plugin on certmgr-01

  • Obtain first Let’s Encrypt cert for lab ISE guest portal

  • Discover ISE OpenAPI cert import endpoint (Swagger UI)

  • Push cert to ISE via API — complete POC

  • Build Ansible playbook for automated push

  • Configure systemd timer for monthly renewal

  • Adapt for production deployment (CR required)

Related Documentation

Notes

Project spans two d001 projects by design — manual renewal may be needed even after ACME automation is live (internal certs remain on Vault/DigiCert). The separation ensures management can choose either path independently.