ISE 2.3 Chromebook BYOD - Certificate installation failed

[Madura Malwatte]

ISE 2.3 patch 5

I am trying to do BYOD with Chromebook and followed the document here - https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-21/200552-Configure-ISE-2-1-for-Chromebook-Onboard.html

In the byod portal I get to step 3 - Install, where a pop up asked "Install certificate to access secure network". I click yes and the next pop up gives an error saying "Certificate failed to install. Contact helpdesk or network administrator".

I enabled errors for the Cisco NSA extension and I can see the error is "Certificate installation failed, no response from the server".

I checked chrome://settings/certificates and can see the ISE server certificate under "Others" tab.

I can successfully provision both Windows and MAC machines without any issues. And its using the same authz policy for the cwa portal for win/mac/chrome.

Any ideas or how I can troubleshoot this further? When it says "no response from the server" does it mean no response from ISE or Google admin console?

[Madura Malwatte]

Does anyone have any suggestions?

[Damien Miller · Accepted solution]

Open a TAC case if you have not yet done that. It's likely going to require debugs and some digging, the failed error message isn't much help.

If you want to try to pull this information yourself, there is a troubleshooting guide at the bottom of the setup page you linked. It covers enabling debugs on ISE and well as leveraging developer mode on the chromebook.

Are you using a public CA root cert on ISE, and issuing certs as a sub CA? Or are you leveraging a self signed ISE root CA?

[Madura Malwatte]

Yeah I guess I will open a TAC case. Thought it might have been something obvious.

I checked the troubleshooting section on that page. That's the only error it gives in chrome in the developer mode. Haven't checked the ISE debugs yet.

The CPP uses a public signed cert. The cert installed in chrome when switching to the secured ssid is the ISE server certificate signed by our internal PKI. The cert issued to BYOD devices is from the self-signed ISE root certificate.