Yes, that is expected behavior. That is way the iOS onboarding was designed and ISE creates interim certificate to support the flow. Since for iOS we are leveraging native over-the-air provisioning we have different experience compared to other OS. All other supported OS (Windows, macOS, Android, Chromebook) creates single certificate as we use Native Supplicant Provisioning wizard app.
