topic The ISE CA is not trusted by in Network Access Control

non-trust cert is shown ,when connect wfi (BYOD solution)

cheungchunyu — Mon, 11 Mar 2019 07:14:00 GMT

Hello,

We bought a cert for ISE.(EAP, admin and default portal).We can check "validate server cert" now.But when we connect to the wifi,it show a non-trust cert.

I have two question.

1.What is that cert?

2.Anyway to let the client trust this cert(already buy a public cert)?

Duncan

Is this with all BYOD devices

Andre Neethling — Wed, 16 Nov 2016 04:56:48 GMT

Is this with all BYOD devices?

From 1.3, ISE has an integrated CA for BYOD. This CA's Root Certificate is self signed. This is most probably the cert you are not trusting.

Hello,

cheungchunyu — Wed, 16 Nov 2016 05:20:58 GMT

Hello,

As I mention,we already import a system cert(not self-signed) in ISE.So I believe that mobile endpoint will not received any warning on cert.

If you said is correct,we need to buy another CA root cert for ise?

Duncan

The ISE CA is not trusted by

Andre Neethling — Wed, 16 Nov 2016 05:36:59 GMT

The ISE CA is not trusted by any mobiles. The ISE generates a ROOT CA cert and then it issues a cert to the ISE Sub/Intermediate CA. This is the CA that issues certs for BYOD.

The truted cert you bought is for the ISE system identification.

Hello,

cheungchunyu — Wed, 16 Nov 2016 05:38:54 GMT

Hello,

Any way to solve this issue or prevent it happen again?

Duncan

Maybe you can add the ISE Sub

Andre Neethling — Wed, 16 Nov 2016 05:41:37 GMT

Maybe you can add the ISE Sub CA and Root CA certs to the trusted certs of the mobiles. But I suspect this is not a viable option due to the fact that the mobiles are not under your control.

Hello,

cheungchunyu — Wed, 16 Nov 2016 05:46:03 GMT

Hello,

I get your mean,but it is not acceptable in our environment .

I will double check that what cert is shown when connect to the wifi.

If you said is ture,I think I need open a support case for this issue.

As mobile device didnt expect recevie a cert when the device just connect the wifi.

Anyway,thank you for your idea.

Duncan

hello,

cheungchunyu — Thu, 01 Dec 2016 05:51:43 GMT

hello,

I double checked ,the showing cert is EAP cert.

We only find the apple devices will showing this untrust cert.

It is a apple device issue.

This is an Apple (iOS) issue. I have raised question in the discussion forum (along with many other users having the same issue)

https://discussions.apple.com/message/23391267#23391267

Other discussions regarding the same issue:

https://discussions.apple.com/message/21869722#21869722

https://discussions.apple.com/message/20237323#20237323

https://discussions.apple.com/message/20338508#20338508

Duncan