Cisco ISE - Computer Certificate authentication

[acapit]

Hey,

I'm doing a new pilot to test some stuff.

I'm trying to authenticate a PC with external certificate. I create a new policy that checks the "Issuer - Fingerprint SHA-256" but for some reason when I'm looking in the ISE Radius logs all I see that the field "Issuer - Fingerprint sha-256" is "not_found" I cant seem to find a reason why its acting like this.

Does anyone have any ideas?

I'm using ise 3.3 patch 4

[andrewswanson]

Hi
Do you have the certificate (that signs the PC certificate) installed in Administration < Certificates > Trusted Certificates on ISE?

Your policy for "Issuer - Fingerprint SHA-256" should then reference that certificate installed on ISE.

hth
Andy

[acapit]

Yes we have the CA certificate that signed the PC certificate in the path you mentioned.

Just to clarify I am looking at the authentication logs and the endpoint has every other field related to the certificate expect from the Issuer SHA-256