ISE 1.1.1 - Error Code 12521 EAP-TLS failed SSL/TLS handshake after a client alert

[kylerossd]

Hello,

Has anyone come across this error code before?  I have looked in the 1.1.1 troubleshooting section and there is nothing there. When I click on the link for the description off the error in ISE I get the following error:

I setup 7925 phones for EAP-TLS using MIC.  I have uploaded Cisco's Root CA and Manufactoring CA Certificates and enabled "Trust for client authentication".  A Certificate Profile is configured matching Common Name and is added to the Identity Sequence.    I got some additional attribute information, where there is a error message:

OpenSSLErrorMessage=SSL alert code=0x233=563 ; source=remote ; type=fatal ; message="decrypt error"

Anyone know what this error means?

[kianarbabifard]

Hi Jatin Katyal,

yes, the ISE suppports SHA-256, but the Phones don't. That's why the log says "12815  Extracted TLS Alert message" and "The request sent by the client was syntactically incorrect" and "12521 EAP-TLS failed SSL/TLS handshake after a client alert".

FIPS mode is disabled anyway.

[kylerossd]

In my case the installed Cisco CA Root is Sha1 2048.  The phones have the same root and manufactoring certificates installed as well as the MIC.

[kianarbabifard]

yes, CiscoRootCA is fine.

But your ISE certificates must be SHA-1 as well.

[don.click1]

Is the only way to support the SHA-256 is to be in FIPS mode? We currently do not use FIPS, but we do want to use SHA-256 for clients. As for our phones (7925;s), I may have the same issues.

[kianarbabifard]

FIPS mode won't do anything useful, if you try to authenticate your 7925 using EAP-TLS.

Let me try to explain:

When using EAP-TLS, the client (7925 in this case) has to trust your authentication server ca (your ISE) and otherwise. To accomplish this, you install the CiscoRootCA and CiscoManufacturingCA on your ISE and install the ISE's root ca certificates on the phones. As soon as your ISE's root ca certificate (which you have to install on the phones) is based on SHA256 it won't work because the phones don't support any certificate basen on SHA256.

To conclude: The only way to authenticate your 7925 using EAP-TLS, you have to make sure your ISE certificates and the appropriate certificate chain is based on SHA1.

[Andrew Woolman]

3 years later and I've run into this issue too. Cisco want us to just use a 2048bit CA cert with SHA-1 when really they should upgrade the firmware of the phone to support 4096 SHA-2