Certificate not installed on Windows 10 endpoint

[sr2290723]

Hi,

I am doing a POC for my customer on ISE 2.2 patch 4. We tried on BYOD provisioning flow using ISE as CA on a Windows 10 endpoint connected to Cisco 2960S switch.

The provisioning process completed successfully, and I can see that the certificate is issued by ISE to the endpoint. However, when I verified in the endpoint, I can’t find it installed in any certificate store (machine or user).

Can anybody give me a light on how to troubleshoot this issue ? Appreciate any input.

Thank you,

Wiyandi

[kthiruve]

Please check out the how to guides for BYOD for step by step procedures using certificates and for on-boarding.

Also I am assuming that after the registration, the endpoint was able to access the network successfully.

ISE Design & Integration Guides

If you can authenticate successfully  I dont see a problem. Make sure you are logging in as administrator for opening local and machine cert.

https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in

-Krishnan

[sr2290723]

Hi Krishan,

Thanks.

The problem is that although Cisco Network Assistant show as completed, but authentication using EAP-TLS fails. I don't even see there is a RADIUS authentication attempt using certificate.

[hslai · Accepted solution]

If the windows user itself is not a local admin user, then the certificate is installed under the certificate store of the local admin user whose credential is used when prompted for UAC. I would suggest either to use the local admin user or add the windows user to the local admin group.

[sr2290723]

Hi hslai,

Thank you. You are right.

So, if customer do not have any CA / PKI setup,I presume that ISE as a CA can’t be used as an alternative for issuing client certificates because company controlled machines where user normally do not have admin right to the machine. Am I right ?

[Jason Kunst]

ISE internal CA is to be used for our BYOD automated process for machines where users have rights to install certs otherwise you need an way to automate