12520 EAP-TLS failed SSL/TLS handshake in ISE 2.1

[N3t W0rK3r]

We are running ISE 2.1 patch 2 in a 4 node deployment, 2 PANs, 2 PSNs.

We are trying to get EAP-TLS setup to authenticate our Windows wireless clients to our new wireless network,

The ISE servers have our internal root CA and intermediate CA certs installed and trusted and user/machine certs are present on the client.

When I client tries to connect to our test SSID, it fails, and I see this error in the Radius live log.

12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

We have tried unchecking "validate server cert" on the client's wifi profile, but we get the same result.

Any ideas?? I have seen other posts here about similar problems but with different versions of ISE.

Thanks in advance.

John

[ajc]

Looks like the ISE Certificate for EAP-TLS was not signed by your internal PKI and that's why it is rejected by the enduser device. You should have something like this on ISE primary PAN and PSN's.

[ajc]

BTW, EAP-TLS is a 2 WAY CERTIFICATE VALIDATION, so you cannot disable on the enduser device profile the "VALIDATE SERVER CERTIFICATE".