ISE 1.3 supported Client Certs

[gtilburg]

Hi,

Our customer is planning to renew their ISE and client certificates to SHA256 instead of SHA1

ISE 1.3 documentation implies that SHA256 is supported for server certificates, however I am not able to find any requirements/limitations for the clients that would do certificate authentication.

What are the limitations for client certificates to be supported for EAP-TLS on ISE 1.3 (and 2.0)?

- keysize?

- Hash?

Regards

Gert

[gtilburg]

hi Jason,

The certificate guide talks about the server side certificate, not the client certificate.

I am looking for requirements on the client certs.

Regards

gert

[Jason Kunst · Accepted solution]

For EAP auth you require Client Authentication in key usage. You can also check cert parameters in our BYOD certs for example.  We support up to 4k key sizes signed using RSA.  ECC certs not sopported until 2.1.  we support SHA-2/256 but not 512.  SHA512 not officially tested, but test said it should work.

There are compatibility concerns on the client side, as well, for key sizes and SHA-2

See RSA Key Sizes: 2048 or 4096 bits? | DanielPocock.com and SHA-256 Compatibility

Simply put: How does certificate-based authentication work? | Network World

Opened defect CSCuy60213 to address this missing in the guide