BYOD Certificate Issue

stanislav.pilat — Wed, 22 Jan 2020 08:05:52 GMT

Hi guys,

I've got a problem with my BYOD deployment (dual SSID) on MacOS Catalina.

Everything works fine until the Network Setup Assistant tries to download a profile.
Even though both of the portals ISE uses in BYOD flow (admin & client provisioning) certificates are signed by a public CA - the NSA shows a warning "the certificate is not valid".
If I click "continue”, I'm able to successfully enroll certificate and join the network.

When i try to connect to both these portals via safari/chrome, the certificate is validated as expected.

It seems to me like the NSA doesn’t have rights to use the Mac’s certificate store.
I know there are some changes for certificates in Catalina (sha1 no longer supported etc..), but our certificates seem to match these new policies.

Using SP wizard version 2.7.0.1
ISE Version 2.4 patch 9 and also tested with 2.6

Catalina 10.15.2

I can open a TAC case, but just wanted to ask here before I do so.

Appreciate every hint 😉

Thank You.

Re: BYOD Certificate Issue

stanislav.pilat — Mon, 23 Mar 2020 14:17:53 GMT

No one? 🙂

Re: BYOD Certificate Issue

hslai — Thu, 26 Mar 2020 00:27:14 GMT

IIRC... this related to the trust settings of certificates in macOS. Similar to what described at Adding A Certificate To The System Keychain Set To Always Trust

Re: BYOD Certificate Issue

thomas — Tue, 31 Mar 2020 00:05:50 GMT

You already have a TAC case open so not going to duplicate efforts.

See How to Ask The Community for Help > The Community is Not TAC

topic BYOD Certificate Issue in Network Access Control

BYOD Certificate Issue

Re: BYOD Certificate Issue

Re: BYOD Certificate Issue

Re: BYOD Certificate Issue