Troubleshooting the ISE License Registration Error  “unable to find valid certification path to requested target”

Issue

When you renew or register licenses from the ISE Admin GUI License Portal Page, you see this error:

"Invalid response from licensing cloud. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"

Environment

• Cisco Identity Services Engine (ISE) version 3.1 and later

• Small to Large ISE deployment

• Direct HTTPS connection method to Cisco Smart Licensing Portal

• Network environment with firewall Secure Sockets Layer (SSL) inspection enabled

Resolution

Step 1: Configure Firewall for SSL Bypass

Configure your firewall to bypass SSL inspection to prevent connection disruptions:

1. Set an exclusion rule for smartreceiver.cisco.com.

2. Ensure that port 443 traffic designated for Cisco license services is included in your SSL inspection bypass policy.

Step 2 : Re-establish ISE License Registration

Refresh your existing ISE deployment licenses:

1. Log in to your Cisco ISE GUI.

2. Go to Administration > System > Licensing.

3. Click Renew Registration to trigger a new connection request to the Cisco license portal.

4. Confirm that the connection status updates to reflect a successful registration

Cause

When you enable SSL inspection, the firewall intercepts the Transport Layer Security (TLS) handshake by presenting its own certificate. Because ISE does not recognize the firewall certificate as a trusted authority, it terminates the connection to maintain security integrity.

Related Content

• Allow the required ISE ports and FQDNs on the network

• Cisco ISE Licensing Guide

• Integrate ISE with Smart Licensing Server