Question

An engineer configures BYOD onboarding using the ISE internal CA. During EAP-TLS authentication after onboarding, employee endpoints that received a certificate from the ISE internal CA fail with a 'certificate chain could not be validated' error on the PSN. The endpoint certificate itself is valid and not expired. What must the engineer verify to resolve the trust validation failure?

Accepted Answer

The ISE internal CA root and node (endpoint) subordinate CA certificates are present in the Trusted Certificates Store with 'Trust for client authentication and Syslog' enabled

Answer

The endpoint certificate template uses a 1024-bit key size to remain compatible with legacy supplicants

Answer

The SCEP RA profile points to an external Microsoft CA instead of the ISE internal CA

Answer

The guest portal FQDN matches the certificate CN presented during web redirection