topic Re: Cisco ISE Certificate Error on iPhone in Network Security

Cisco ISE Certificate Error on iPhone

latenaite2011 — Tue, 16 Aug 2022 11:33:09 GMT

Does anyone know why the iPhone's certificate is not trusted (see attached) image. There is no error in Cisco ISE's live log but did see a message in ISE under the certificate section saying that this certificate is NOT used to verify the authenticity of client certificate presented to ISE..(see attached image also) but that has been fixed and the certificate was pushed via Microsoft Intune.

Thanks in advance!

Re: Cisco ISE Certificate Error on iPhone

balaji.bandi — Tue, 16 Aug 2022 12:43:34 GMT

Is the Certificate Public CA signed or Local PKI ?

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Tue, 16 Aug 2022 14:46:29 GMT

Thanks Balaji for the quick response.

It is an internal Microsoft CA server and you can see in the attached iphone snapshot provided that it has been installed in the iphone, just the intermediary cert that isn't taken. Does this need to be in FDQN?

thanks!

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Tue, 16 Aug 2022 15:23:18 GMT

Hi Balali,

Forgot to include the other snapshot that may be helpful, sorry forgot to include that earlier

Re: Cisco ISE Certificate Error on iPhone

balaji.bandi — Tue, 16 Aug 2022 16:09:55 GMT

if that is internal CA, that is expected. or you need to manually upload root certificate to devices. - so the device can trust your Local CA certs

Re: Cisco ISE Certificate Error on iPhone

rsharp001 — Tue, 16 Aug 2022 16:53:38 GMT

I only see the iphone-2 photo showing the cert being presented is not trusted, assuming it is because it cannot be verified by the endpoint.

The only way I've had any success with getting my internal CA trusted on an iphone was by using an MDM to push the CA to the endpoint trust store before attempting to connect to our internal wireless.

Robert

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Tue, 16 Aug 2022 17:17:10 GMT

Thanks for the reply Robert. Yes, we used Microsoft Intune to push the certificate to the iPhone and you can see the root certificate installed on the iPhone but not the internal CA certificate. The iPhone shows that it is not trusted and with over 1K, it should be trusted automatically (the internal CA certificate has bee installed on the in ISE and it can see it). Just wondering why the iPhone doesn't trust it automatically and had to hit the "Trust" option. It wouldn't be feasible to hit the trust button on every phone. thanks!

Re: Cisco ISE Certificate Error on iPhone

rsharp001 — Tue, 16 Aug 2022 19:11:12 GMT

When you say root certificate, do you mean from ISE? Since you're specifying both I'm assuming the internal CA is your MS PKI and the root is from ISE. If that is the case, which one of them signed the certificate that is presented to the device by ISE? Look in Admin -> Certificates and look for the one being used for EAP authentication, make sure the issued by is indeed the certificate you are pushing with Intune into the trust store

Re: Cisco ISE Certificate Error on iPhone

rsharp001 — Thu, 18 Aug 2022 21:39:50 GMT

hey @latenaite2011 - I'm curious if you were able to get to the bottom of this issue?

Re: Cisco ISE Certificate Error on iPhone

balaji.bandi — Fri, 19 Aug 2022 07:46:56 GMT

try :

https://docs.microsoft.com/en-us/mem/intune/protect/certificates-trusted-root

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Fri, 19 Aug 2022 08:07:06 GMT

Hi Rsharp001, thanks for your reply.

The certs are pushed from the CA Server just fine (both the root and the
intermediate). I'll check if the same certificaticate used for EAP is the
same one as pushed by Intune into the trust store.

thank you!

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Fri, 19 Aug 2022 08:07:08 GMT

Will do thanks Balaji!

Re: Cisco ISE Certificate Error on iPhone

latenaite2011 — Tue, 08 Nov 2022 17:44:31 GMT

No Rsharp001 - still having the same issue.