Hi there!
I'm having the same issue with SBEN that reject the ISE certificate. This does happen after a while though. It goes through onboarding fine and it's after around a week they start rejecting the ISE certificate and will stay permanently in sben_limited. I also confirmed that the intermediate CA certificate is not pushed to the SBEN. Is it possible to provide this with a Day-0 template so the onboarding does not require any manual input?