topic Re: Apple Devices not trusting public CA signed cert when connect 802. in Network Access Control

Apple Devices not trusting public CA signed cert when connect 802.1X

kshah2589 — Fri, 03 May 2024 16:34:37 GMT

Hello,

We have installed the public CA signed cert in the ISE nodes.

this is for BYOD devices which we are not managing so whenever apple devices trying to connect Wi-Fi using 802.1X auth they still need to manually trust the certificate for connection. we don't have the same problem with Android/Windows devices.

Let me know if you guys have any suggestions.

Regards,

Kunal Shah

Re: Apple Devices not trusting public CA signed cert when connect 802.

Mark Elsen — Fri, 03 May 2024 16:41:39 GMT

- FYI : https://community.cisco.com/t5/network-access-control/ios-wireless-users-being-prompted-to-trust-public-certificate/m-p/3826323#M474846

Re: Apple Devices not trusting public CA signed cert when connect 802.

Rob Ingram — Fri, 03 May 2024 17:28:41 GMT

@kshah2589 iDevices (iPad's/iPhones) have to manually Trust the certificates for each PSN.

Refer to the Cisco Live presentation BRKSEC-2234

You can resolve this by using a WildSAN or MultiSAN certificate, the same certificate is used by all PSNs for the EAP authentication.

Re: Apple Devices not trusting public CA signed cert when connect 802.

MHM Cisco World — Fri, 03 May 2024 17:34:26 GMT

Sorry can you more elaborate

How many PSN you have

What is CN and SAN you use in your PSN identity Cert

Thanks

MHM

Re: Apple Devices not trusting public CA signed cert when connect 802.

kshah2589 — Fri, 03 May 2024 18:19:09 GMT

We are using MultiSAN certificate with same certificate installed in both PSN but still getting an error.

Re: Apple Devices not trusting public CA signed cert when connect 802.

kshah2589 — Fri, 03 May 2024 18:21:32 GMT

We have 2 PSN in our environment one in east coast and second in west coast , CN = abc.domain.com and SAN1 = abc.domain.com(first PSN) and SAN2 = xyz.domain.com(second PSN)

Re: Apple Devices not trusting public CA signed cert when connect 802.

MHM Cisco World — Fri, 03 May 2024 19:32:20 GMT

OK, can you try this
add new test WLAN and add first PSN only as AAA server and check if the macOS can connect or not.
if it can connect then issue with SAN of Cert

MHM

Re: Apple Devices not trusting public CA signed cert when connect 802.

kshah2589 — Fri, 03 May 2024 20:16:38 GMT

Thanks for suggestions but Android/Windows doesn't have problem. Do you still want to me test?