topic Re: 12520 EAP-TLS failed SSL/TLS handshake in ISE 2.1 in Network Access Control

12520 EAP-TLS failed SSL/TLS handshake in ISE 2.1

N3t W0rK3r — Fri, 21 Feb 2020 18:39:58 GMT

We are running ISE 2.1 patch 2 in a 4 node deployment, 2 PANs, 2 PSNs.

We are trying to get EAP-TLS setup to authenticate our Windows wireless clients to our new wireless network,

The ISE servers have our internal root CA and intermediate CA certs installed and trusted and user/machine certs are present on the client.

When I client tries to connect to our test SSID, it fails, and I see this error in the Radius live log.

12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

We have tried unchecking "validate server cert" on the client's wifi profile, but we get the same result.

Any ideas?? I have seen other posts here about similar problems but with different versions of ISE.

Thanks in advance.

John

Re: 12520 EAP-TLS failed SSL/TLS handshake in ISE 2.1

ajc — Wed, 22 Nov 2017 19:56:54 GMT

Looks like the ISE Certificate for EAP-TLS was not signed by your internal PKI and that's why it is rejected by the enduser device. You should have something like this on ISE primary PAN and PSN's.

Re: 12520 EAP-TLS failed SSL/TLS handshake in ISE 2.1

ajc — Wed, 22 Nov 2017 19:59:02 GMT

BTW, EAP-TLS is a 2 WAY CERTIFICATE VALIDATION, so you cannot disable on the enduser device profile the "VALIDATE SERVER CERTIFICATE".