https://community.cisco.com/t5/network-access-control/authenticating-a-device-with-certificates-using-ise/m-p/4396997#M567085 <P>Few items for consideration: Is this possibly something for another customer? If so, any chance you could enroll them with your internal PKI &amp; use that cert to onboard the non-domain clients to your network? Who will manage the configuration of the supplicant (you/external domain)?&nbsp; Also, what type of supplicant will be in use? You will need to consider how to do certificate matching if the client will have multiple identity certs from different domains.&nbsp; If the clients have an identity cert and you trust the chain, have you considered simply adding the external chain into your ISE trust store to support onboarding via their own PKI certs?</P> Mon, 03 May 2021 13:14:08 GMT Mike.Cifelli 2021-05-03T13:14:08Z https://community.cisco.com/t5/network-access-control/authenticating-a-device-with-certificates-using-ise/m-p/4396926#M567083 <P>I want to authenticate a device which is not on the domain (not connected to AD), using certificate. Is it possible to do certificate based authentication using the ISE default certificate? by generating CSR. etc.</P><P>The device doesn't allow username/password authentication, can I use the certificates only? Like when you configure SSH with pub-key.</P> Mon, 03 May 2021 10:45:55 GMT https://community.cisco.com/t5/network-access-control/authenticating-a-device-with-certificates-using-ise/m-p/4396926#M567083 SMD28316 2021-05-03T10:45:55Z https://community.cisco.com/t5/network-access-control/authenticating-a-device-with-certificates-using-ise/m-p/4396997#M567085 <P>Few items for consideration: Is this possibly something for another customer? If so, any chance you could enroll them with your internal PKI &amp; use that cert to onboard the non-domain clients to your network? Who will manage the configuration of the supplicant (you/external domain)?&nbsp; Also, what type of supplicant will be in use? You will need to consider how to do certificate matching if the client will have multiple identity certs from different domains.&nbsp; If the clients have an identity cert and you trust the chain, have you considered simply adding the external chain into your ISE trust store to support onboarding via their own PKI certs?</P> Mon, 03 May 2021 13:14:08 GMT https://community.cisco.com/t5/network-access-control/authenticating-a-device-with-certificates-using-ise/m-p/4396997#M567085 Mike.Cifelli 2021-05-03T13:14:08Z