I had this recently on an ISE 2.4 deployment. I was trying to be clever by issuing a separate Admin cert and an EAP cert, because splitting these two certs makes a lot of sense. The mistake I made was that I created the CSR with the Same Subject CN. e.g. ise1.company.com for Admin cert, and ise1.company.com for EAP cert.
ISE allowed me to create these two CSR's. But when I tried to bind the EAP cert after I had already successfully bound the Admin cert, ISE complained about that and told me that I cannot have that. I think it's a feature but to me it seems wrong. Not sure if this worked in earlier versions (I have never tried that before). There should be no confusion here because the certs are unique in their serial number and they also serve different purposes.
My solution was to create a new CSR for the EAP cert and I called it simply: ise1 (without the domain). EAP supplicants don't care about the Subject CN anyway. In the SAN you can still put whatever you like - so I put the FDQN in there.
Other possible solution is to change the CSR's Organisational Unit (OU), Organisation, City etc. - make them unique - then it's not an issue for ISE.
