Certificate requirements for Cisco ISE nodes

Updated: November 12, 2026

Want to summarize with AI?

Lists the certificate and SAN requirements for Cisco ISE nodes in order to ensure secure and successful integration with the Cisco ISE Cloud Central Agent.

The Cisco ISE Cloud Central Agent verifies the identity of each Cisco ISE node it connects to, including over pxGrid. The node’s Admin and pxGrid certificates must meet these requirements:

The Subject Alternative Name (SAN) must include the node’s fully qualified domain name (FQDN) as a DNS name, such as DNS:ise1.example.com.
The SAN can also include the node’s IP address.
The certificate must be within its validity period.
If the certificate is CA-signed, the issuing CA certificates must be in the Cisco ISE Trusted Certificates store.

Cisco ISE-generated certificates, including the default self-signed certificate and pxGrid certificates issued by the Cisco ISE internal CA, meet these requirements. If you use a certificate signed by an external CA, make sure the SAN includes the node’s FQDN as a DNS name.

The agent does not support certificates that identify the node only by its Common Name (CN) or IP address.

If a certificate is unsupported, installation does not complete. Reissue it with the node’s FQDN as a DNS name in the SAN, then run the installation again.

Table 1. Certificate requirements for Cisco ISE nodes
Certificate identity	Supported
SAN includes `DNS:ise1.example.com`	Yes
SAN includes `DNS:ise1.example.com` and `IP:192.0.2.10`	Yes
CN is `ise1.example.com`; SAN includes only `IP:192.0.2.10`	No
CN is `ise1.example.com`; certificate has no SAN	No
SAN includes a DNS name that does not match the node’s FQDN	No

Why the agent checks the certificate?

The agent sends Cisco ISE administrator credentials and receives session and endpoint data. It checks the DNS name in the SAN to verify the identity of the Cisco ISE node before exchanging this information. RFC 9525 specifies that clients identify DNS names using the dNSName SAN and must not use the CN for this purpose.

Check the certificate SAN

Run this command from a host that can reach the Cisco ISE node:

openssl s_client -connect <ISE-node-FQDN>:8910 </dev/null 2>/dev/null | openssl x509 -noout -ext subjectAltName

The output must include DNS:<ISE-node-FQDN>. To inspect the Admin certificate, use port 443 instead of 8910. This command displays the SAN; it does not confirm certificate validity or CA-chain trust.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.