topic Cisco ISE - Computer Certificate authentication in Network Access Control

Cisco ISE - Computer Certificate authentication

acapit — Wed, 11 Jun 2025 10:53:59 GMT

Hey,

I'm doing a new pilot to test some stuff.

I'm trying to authenticate a PC with external certificate. I create a new policy that checks the "Issuer - Fingerprint SHA-256" but for some reason when I'm looking in the ISE Radius logs all I see that the field "Issuer - Fingerprint sha-256" is "not_found" I cant seem to find a reason why its acting like this.

Does anyone have any ideas?

I'm using ise 3.3 patch 4

Re: Cisco ISE - Computer Certificate authentication

andrewswanson — Wed, 11 Jun 2025 15:37:01 GMT

Hi
Do you have the certificate (that signs the PC certificate) installed in Administration < Certificates > Trusted Certificates on ISE?

Your policy for "Issuer - Fingerprint SHA-256" should then reference that certificate installed on ISE.

hth
Andy

Re: Cisco ISE - Computer Certificate authentication

acapit — Thu, 12 Jun 2025 07:11:46 GMT

Yes we have the CA certificate that signed the PC certificate in the path you mentioned.

Just to clarify I am looking at the authentication logs and the endpoint has every other field related to the certificate expect from the Issuer SHA-256