different certs used for eap on endpoint attached to switch port

[mpeeters]

Forwarding question: Currently the workstations have been configured are all working fine with a legacy SHA1 certificate and PEAP-TLS but the Avaya ip phones do not authenticate with the error “12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate”.

One issue is that the phones currently use a SHA256 certificate for EAP-TLS and the workstations use SHA1. We are due to upgrade to SHA256 for the workstations in the coming months but have an issue with compatibility as currently a 4.2 ACS server which is currently in place does not work on 2008R2 potentially breaking our radius authentications.

So the plan was to replace ACS with ISE and then upgrade the certificate server when we hit the current issue. Is it possible to have 2 different EAP-TLS authentication certificates? I did attempt this but when I go to bind the cert ISE states that this will override the current binding. Otherwise is there a temporary solution to MAB the ip phones and dot1x the workstations?

[Surendra · Accepted solution]

You cannot have two different certificates for EAP on a single ISE server.

You can check with Avaya support if there is a way to stop the phones from talking EAP (doing dot1x). If they can, then yes, you can have the phones do MAB and the PCs will continue to do dot1x.