Security

Hi

I assume you are referring to the https certificate in ClearPass?

If so you should pay attention to keep the same SAN names in the new certificate as this certificate is not only utilized for the https traffic for the guests when browsing the captive portal pages, but also the management access to the ClearPass server. If you are using Downloadable User Roles for switches or WLAN, you should also make sure to have the new certificate issued by the same root CA. If not you have to make sure your network infrastructure trust the new CA, or the Downloadable User Role download may stop working.

If all this is correct, changing the certificate is easy. After the new certificate has been installed it may take up to a few minutes before it has been applied fully.

Export the old certificate and keep as backup if you need to do a rollback.

Hi @jonas.hammarback , Thank you for the update. If we have multiple SAN names, how should we include them in the SAN name field of the Clearpass CSR?

Hi

I assume you are referring to the https certificate in ClearPass?

If so you should pay attention to keep the same SAN names in the new certificate as this certificate is not only utilized for the https traffic for the guests when browsing the captive portal pages, but also the management access to the ClearPass server. If you are using Downloadable User Roles for switches or WLAN, you should also make sure to have the new certificate issued by the same root CA. If not you have to make sure your network infrastructure trust the new CA, or the Downloadable User Role download may stop working.

If all this is correct, changing the certificate is easy. After the new certificate has been installed it may take up to a few minutes before it has been applied fully.

Export the old certificate and keep as backup if you need to do a rollback.

Hi @jonas.hammarback , Thank you for the update. If we have multiple SAN names, how should we include them in the SAN name field of the Clearpass CSR?

Original Message:
Sent: Aug 16, 2024 09:55 AM
From: jonas.hammarback
Subject: ClearPass Guest Certificate Renewal

Hi

I assume you are referring to the https certificate in ClearPass?

If so you should pay attention to keep the same SAN names in the new certificate as this certificate is not only utilized for the https traffic for the guests when browsing the captive portal pages, but also the management access to the ClearPass server. If you are using Downloadable User Roles for switches or WLAN, you should also make sure to have the new certificate issued by the same root CA. If not you have to make sure your network infrastructure trust the new CA, or the Downloadable User Role download may stop working.

If all this is correct, changing the certificate is easy. After the new certificate has been installed it may take up to a few minutes before it has been applied fully.

Export the old certificate and keep as backup if you need to do a rollback.

------------------------------
Best Regards
Jonas Hammarbäck
MVP Guru 2024, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

Original Message:
Sent: Aug 16, 2024 08:19 AM
From: Mithran
Subject: ClearPass Guest Certificate Renewal

Hi @jonas.hammarback , Thank you for the update. If we have multiple SAN names, how should we include them in the SAN name field of the Clearpass CSR?

Hi

I assume you are referring to the https certificate in ClearPass?

If so you should pay attention to keep the same SAN names in the new certificate as this certificate is not only utilized for the https traffic for the guests when browsing the captive portal pages, but also the management access to the ClearPass server. If you are using Downloadable User Roles for switches or WLAN, you should also make sure to have the new certificate issued by the same root CA. If not you have to make sure your network infrastructure trust the new CA, or the Downloadable User Role download may stop working.

If all this is correct, changing the certificate is easy. After the new certificate has been installed it may take up to a few minutes before it has been applied fully.

Export the old certificate and keep as backup if you need to do a rollback.

Hi

The syntax for the SAN in the ClearPass CSR dialogue is DNS:name1.domain.com,DNS:name2.domain.com.

As @GorazdKikelj mention there are also an option to add the SAN fields during the ordering process with some public CA's

Hi @jonas.hammarback , Thank you for the update. If we have multiple SAN names, how should we include them in the SAN name field of the Clearpass CSR?

Hi

I assume you are referring to the https certificate in ClearPass?

If so you should pay attention to keep the same SAN names in the new certificate as this certificate is not only utilized for the https traffic for the guests when browsing the captive portal pages, but also the management access to the ClearPass server. If you are using Downloadable User Roles for switches or WLAN, you should also make sure to have the new certificate issued by the same root CA. If not you have to make sure your network infrastructure trust the new CA, or the Downloadable User Role download may stop working.

If all this is correct, changing the certificate is easy. After the new certificate has been installed it may take up to a few minutes before it has been applied fully.

Export the old certificate and keep as backup if you need to do a rollback.