ACS self-signed certificates - renewals?

Question

We are using the ACS self-signed certs - good for 1 year. We are using PEAP and when configuring the wireless users, we disable the option to "prompt user to authorize new servers or trusted cert authorities."
Is there a way to renew the cert (or generate a new cert) and not require a physical visit to the computer to redo the wireless setup?
Perhaps a way to generate a new cert that is named the same as the existing cert? Maybe then I could push out the cert via a GPO.
Thanks for any help....our cert will expiring in the month (or so) and we are trying to figure out a game plan that doesn't involve touching every computer.

Answer 1

Hi,
The kind of certificate it is a regular server certificate.
You could you a windows 2003 as a CA that is a lot cheaper to get one of those and you can make the certificate for as many years do you want.
Please see link below that explains how certificates needs to be request and how to use windows 2003 as a CA.
http://tinyurl.com/9hq4r
If you decide to use another CA you will need the following instructions
Step 1: Create a Certificate Signing Request
Complete these steps:
1.
Choose System Configuration > ACS Certificate Setup > Generate Certificate Signing Request.
2.
Enter a name in the Certificate subject field with the cn=name format.
3.
Enter a name for the private key file.
Note: The path to the private key is cached in this field. If you press submit a second time after the CSR is created, the private key is overwritten and does not match the original CSR. This result in a private key does not match error message when you attempt to install the server certificate.
4.
Enter the private key password and confirm it.
5.
Choose a key length of 1024.
Note: While Cisco Secure ACS can generate key sizes greater than 1024, the use of a key larger than 1024 does not work with PEAP. Authentication might appear to pass in Cisco Secure ACS, but the client hangs while authentication is attempted.
6.
Click Submit
7.
Copy the CSR output on the right-hand side for submittal to the CA.
Once this has been created you send it to the CA and they know what to do.
If you need any assistance let me know.