topic Re: EAP Authentication certificate expiry in CISCO ISE in Network Access Control

EAP Authentication certificate expiry in CISCO ISE

poornakumar — Sat, 12 Oct 2024 14:55:36 GMT

Hi Team,

If we renew EAP authentication certificate is there any pop up will shown to accept or trust the certificate in endpoints. If it shows pop up is there any way to handle it.

Re: EAP Authentication certificate expiry in CISCO ISE

Rob Ingram — Sat, 12 Oct 2024 15:00:25 GMT

@poornakumar ensure EAP certificate is signed by a Certificate Authortiy that is trusted by the client computer, meaning the root CA certificate is in the trust certificate store of the client computer, then replacing the EAP certificate would not cause a pop-up and would be transparent to the users.

Re: EAP Authentication certificate expiry in CISCO ISE

poornakumar — Sat, 12 Oct 2024 15:02:09 GMT

Thanks for the reply

Re: EAP Authentication certificate expiry in CISCO ISE

MHM Cisco World — Sat, 12 Oct 2024 17:13:24 GMT

check this Note

MHM

Re: EAP Authentication certificate expiry in CISCO ISE

JPavonM — Tue, 15 Oct 2024 06:48:43 GMT

All of this works for Windows but not MacOS, as the new certificate must be inside the wirless profile, and that may trigger a pop up window requesting explicit Trust from the end user.

Re: EAP Authentication certificate expiry in CISCO ISE

poornakumar — Wed, 16 Oct 2024 18:30:55 GMT

Actually today P1 raised for this issue.We have extended the certificate validity of the old self signed certificate but endpoint doesnt trust that certificate. But TAC mentioned like the existing certfiicate will get automatically renew. but it is not working as expected. So as a resolution we go for external CA. Issue got fixed within 10 min but it create a big issue.