Recently I replaced the Certificate for EAP Authentication on our Corporate Wireless ISE deployment with a like for like Certificate with a new expiration date. The Certificate has the Intermediate and Root listed in the Certification path, the issue I'm having is the new cert like the old one is SHA256, the intermediate and root are both showing as SHA384 which 99% of the clients are working fine but I have a handful that worked previously and are no longer able to connect.
In ISE I see the error: 12321 : PEAP failed SSL/TLS handshake because the client rejected the ISE local-certificate
on the medical device we did a packet capture which shows ISE sending the certificate with the full chain which the device doesn't like and sends: Alert (level: Fatal, Description: Bad Certificate ) packet.
Does ISE always send the EAP cert with the full chain or is there any way to strip out the chain? The vendor is saying their devices aren't able to use SHA384 and the issue is with the intermediate and root. I'd rather not replace the EAP Authentication cert again if possible.
Thanks for any help that is provided.
