topic Re: Renewal Certificate ISE in Wireless

Renewal Certificate ISE

dungtran.90 — Mon, 05 Jul 2021 17:53:52 GMT

Dear All

I have a case below:

I have an ISE node. EAP certificate is expired so I renewal it and received the certificate from Zone which is using normal for other sites ( Europe, India, America..) But in Vietnam, we met the issue as the picture below. We change the EAP certificate from Comodo to Sectigo. Import successfully to ISE, a client can connect now, but it does not automatically connect anymore, every time we move to another AP we need to click connect twice.

Could you please help or support?

Thanks

DungTran

Re: Renewal Certificate ISE

patoberli — Fri, 23 Aug 2019 12:54:57 GMT

Do you have more than one Radius server configured? If yes, do both use the same root certificate / issuer of the certificate?
If not, then this is the normal behavior.
Make sure that the certificate shown to the client is actually the correct one and not a Man in the Middle attack with a rogue access point.

Re: Renewal Certificate ISE

pieterh — Fri, 23 Aug 2019 14:13:34 GMT

"show certificate details" may guide you to the root cause

possibilities:

- the host-name does not match the name in the certificate

this would be immediately shown

- when using multiple ISE servers , you may need to configure SAN names in the certificate
certificate details -> alternate names

- you may have imported a certificate with incorrect certification-chaining

certificate details -> certification path

Re: Renewal Certificate ISE

Ambuj M — Sat, 24 Aug 2019 22:46:59 GMT

Some additional basic checks ...

verify Sectigo root cert chain in present on client.

On ISE end I am sure you check Sectigo root cert to be used for client authentication.

Re: Renewal Certificate ISE

dungtran.90 — Mon, 26 Aug 2019 04:36:15 GMT

Dear Ammahend
Root cert already verified by Zone.
So in the ISE end, i need to enable: Trust for client authentication and Syslog ?
Thanks
DungTran

Re: Renewal Certificate ISE

Ambuj M — Mon, 26 Aug 2019 05:37:51 GMT

yes If you are using this certificate for client EAP auth.