Hi,
Using ISE 2.2, Android 5.0 devices are successfully going through the BYOD provisioning flow. Android 6.0 devices, however, fail every time on "Installing Certificates..." screen on the agent with the message "Certificate Generation Failed". Error screenshot attached. This happens with both the Single-SSID or Dual-SSID method of on-boarding. The Dual-SSID method uses an Open Auth Guest WLAN and redirect to BYOD portal for qualified users. ISE, acting as Sub-CA to the corporate Root CA, issues certificates to the BYOD devices.
The "spw.log" file on the Android 6.0 (Samsung, LG) device logs this after it downloads the xml file from ISE node:
.....
2017.02.21 16:33:32 INFO:EST Server =ise02.example.com
2017.02.21 16:33:32 INFO:EST Server port =8084
2017.02.21 16:33:32 INFO:ISEDownloadProfileAsynchTask.onPostExecute :PASSED
2017.02.21 16:33:54 INFO:Making SCEP call
2017.02.21 16:33:54 INFO:Generating RSA key with key size: 2048
2017.02.21 16:33:56 INFO:Going to call EST server with args: cn = stuarts@example.com, un= stuarts@example.com, sn= ise02.example.com, sp =8084, cur= P-384, ca_certs length = 8486
2017.02.21 16:33:56 INFO:Calling native logger init with : /storage/emulated/0/Download/estlog.txt
2017.02.21 16:33:56 INFO:SPW profile is having certificate parameters
2017.02.21 16:34:44 INFO:EnrollCert Native returned pem len = 16384
2017.02.21 16:34:44 ERROR:ISEEnrollmentAsynchTask
2017.02.21 16:34:44 ERROR:java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference
2017.02.21 16:34:44 ERROR:Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference
2017.02.21 16:34:44 INFO:Internal system error.
The same execution point in the "spw.log" for the Android 5.0 (Samsung) device goes through successfully:
.....
2017.02.21 17:03:35 INFO:EST Server =ise02.example.com
2017.02.21 17:03:35 INFO:EST Server port =8084
2017.02.21 17:03:35 INFO:ISEDownloadProfileAsynchTask.onPostExecute :PASSED
2017.02.21 17:03:35 INFO:Making SCEP call
2017.02.21 17:03:35 INFO:Generating RSA key with key size: 2048
2017.02.21 17:03:36 INFO:SPW profile is having certificate parameters
2017.02.21 17:03:36 INFO:Cert request pending - Making pending cert call
2017.02.21 17:03:38 INFO:checkServerTrusted call
2017.02.21 17:03:38 INFO:Generated cert from SCEP server = [0] Version: 3
.....
The closest I could find is this bug "CSCug69605" although the log message is different to what I get and using different ISE version
Has any one seen this before? Any workaround?
Regards,
Rick.
