topic Re: Untrusted Certificate when performing PEAP Authentication in Network Access Control

Untrusted Certificate when performing PEAP Authentication

cgarthvdb — Mon, 04 Dec 2017 10:49:16 GMT

Hi All,

I have an ISE deployment and we generated a MultiUse CSR and signed it using Comodo Public CA, the certificate works 100% when accessing the Portals (CWA) Admin etc however when authenticating a wireless client using PEAP some clients report a certificate trust error.

Has anyone experienced the same issue or know of a solution to this?

Regards

Garth

Re: Untrusted Certificate when performing PEAP Authentication

Jason Kunst — Mon, 04 Dec 2017 16:23:57 GMT

What clients? For ios devices you will need to manually trust the certificate upon initial connection even though it’s a valid certificate.

https://www.google.com/search?ei=UHYlWrKIL4W5ggfPnZrwDQ&q=iosmanualtrustcertpeap&oq=iosmanualtrustcertpeap&gs_l=psy-ab.3..33i160k1l2.34357.35016.0.35204.5.5.0.0.0.0.137.475.1j3.4.0....0...1.1.64.psy-ab..1.4.475...33i22i29i30k1.0.RbyEieLab0Q

Re: Untrusted Certificate when performing PEAP Authentication

hslai — Tue, 05 Dec 2017 03:49:34 GMT

As Jason said, this is expected on many client operating systems. On Apple iOS, for example, it shows the certificate of ISE EAP server as "Not Verified" while using an ad-hoc Wi-Fi WPA2 enterprise connections. http://training.apple.com/pdf/WP_8021X_Authentication.pdf says,

... The first time the user joins a device to an 802.1X-protected network, the device will prompt the user to trust the server’s certificate.

In order to make the certificate trusted, it needs included as part of a configuration profile installed via ISE BYOD, Apple Configurator 2, or a 3rd-party MDM.

Re: Untrusted Certificate when performing PEAP Authentication

cgarthvdb — Tue, 05 Dec 2017 07:20:45 GMT

Hi there, thank you for the response, we are experiencing this issue on different clients, mostly Apple devices but have also experienced it on some Windows 7 PC's. Android devices are not affected.

Re: Untrusted Certificate when performing PEAP Authentication

cgarthvdb — Tue, 05 Dec 2017 07:22:45 GMT

Thank you, unfortunately it is not only apple iOS devices, we are having the same issue on some corporate windows PC's.

This is very strange, I have logged a TAC with Cisco and am awaiting feedback.

Re: Untrusted Certificate when performing PEAP Authentication

hslai — Tue, 05 Dec 2017 09:02:55 GMT

Discovering the Advanced Client Settings of 802.1X - TechGenix

might help.

The native supplicant on Windows client OS by default validates the server certificate of EAP servers and also often prompts to confirm the authenticating EAP server associated with the expected Wi-Fi network ID.