Question

A network engineer is preparing ISE to issue certificates to BYOD endpoints using the ISE internal CA. During validation, the engineer notices that the certificates presented to onboarded endpoints must chain to a trusted root. To ensure the internal CA can sign endpoint certificates while maintaining a proper trust chain in a distributed deployment, which statement correctly describes how the ISE internal CA hierarchy is structured?

Accepted Answer

The Primary PAN acts as the Root CA, and each PSN operates as a subordinate CA that signs endpoint certificates issued to devices it services.

Answer

Each PSN generates its own self-signed Root CA that independently signs endpoint certificates without any relationship to the PAN.

Answer

The internal CA can only issue endpoint certificates from the Primary PAN, so all onboarding traffic must be redirected to the PAN.

Answer

An external enterprise Root CA must sign all ISE node certificates before the internal CA can issue any BYOD endpoint certificates.