Certificate Error during Posture Unknown State

[AIN UL BADAR]

Hello folks,

I'm getting the attached error cert message/warning the moment I open up IE on Windows 10. I'm doing Posture with ISE 2.4. 

The Switch pushes the redirect URL and AnyConnect pops-up an option to choose the browser i.e. either IE or Chrome. 

When I open up IE, it shows this error message. This error is confusing to me, because ISE and the website in the image IE is automatically trying to open up, are both provisioned Certificates by the same Sub-CA. 

Sub-CA and Root CA are Internal CAs, and are Trusted by IE in it's Certificate store as "Intermediate Certification Authorities" and "Trusted Root Certification Authorities" respectively.

How can I fix the it. 

Appreciate the help.

Thanks

Ain

[AIN UL BADAR]

Error Code: DLG_FLAGS_INVALID_CA
DLG_FLAGS_SEC_CERT_CN_INVALID

[Damien Miller]

Look in the certificate details. It's likely that "blueflash.bankoh.net" is not present as a Subject Alternative Name (SAN).

The cert needs to be signed for any URL you use, not just the server hostnames that present it.

[AIN UL BADAR]

Thank you. I mistakenly hit the Solution button. The problem is still there.

Found out that the website has wildcard in the CN field. I read in the documentation that microsoft doesn't support certificates with wildcards in the CN field, instead the cert can have wildcard in the SAN field.

BUT, this is not the problem, because when we browse internally to that website (without Posture/redirect), it doesn't throw any error message. Then Why it is sending a warning message upon redirect?

Thanks for your help.

Ain

[Damien Miller]

There have been issues with microsoft workstations that have the wild card in the CN, so it is definitely not recommended. I have used them successfully in deployments with the wild card in the SAN.

Can you share a couple screenshots of the certificate details, specifically the Subject field and the Subject Alternative Name field?

[AIN UL BADAR]

Attached are the Certs. One from the website (that endpoint automatically tries to go to upon URL Redirect) and the other one if from ISE.

Sorry had to mask the details little bit, but I hope you'll get the point.

Let me know if you need anything else.

Thanks for your help.

Ain