If you have a Windows 2003 based Certificate Authority (CA) in your enterprise, you need to keep one thing in mind when generating a Certificate Signing Request (CSR) from Cisco ISE. By default Cisco ISE uses SHA-256 for the CSR. Windows 2003 only supports SHA-1. So when you generate the request, make sure to select SHA-1. This will save you countless headaches and hours of frustration.