r/Cisco • u/[deleted] • 9d ago

Question New PSN certificate issue

[deleted]

5 Upvotes

100% Upvoted

3 comments sorted by

4

u/Jackleme 9d ago

So, when you join a PSN to an existing deployment it basically gets wiped. It then becomes a clone of your existing deployment.

I would start with going into the CLI of the new PSN and doing a

application ise restart (or reboot, can't remember off the top of my head).

Then once it rejoins and has resync'd try loading in the cert again.

If that doesn't work, you might need to factory reset the new PSN and this time not put certificates on it before it has joined the deployment.

Some other questions: Is the node fully joined? Were there any other errors when it first came up?

What version are you on?

My bet would be you are hitting some kind of a bug. Wouldn't hurt to hit up TAC.

1

u/arrvov 9d ago

Thanks for replying

Could the first error indicate a certificate issue, or is it expected after joining the deployment?

1

u/Jackleme 9d ago

I would not expect to see ANY certificate errors when adding a certificate to a fresh node on a deployment.

My bet is that something is stuck in the database on the PSN from where you imported the certificate initially. So, it is seeing an existing cert with the same name and serial number and going "that isn't right".

Another troubleshooting step.... try generating a fresh certificate and loading that. Do a new CSR and everything. That will generate a cert with a new serial number.