ISE BYOD question regarding MSCEP certificate request

[kpeters011]

In the BYOD model for certificate request/retrieval is the returned certificate from an external MCSEP (Microsoft 2012 R2 server CA) uniquely identified by the device MAC address or username?? If the same device was to attempt network access/authentication through the ISE BYOD portal will it always get the same certificate??

Can BYOD portal be setup to handle wired access attempts (as opposed to wireless)??

[Francesco Molino · Accepted solution]

Hi

When doing byod, on the device provisioning certificate, the username will be used as CN and Mac address as SAN.

If the same device is making a new request the cn and san will be the same but the certificate will be different as the serial number will change for example. You can check that on your windows ca server, each time you request a certificate from the same device it will generate a new certificate.

For wired byod, yes you can implement that. Here a Cisco documentation:
https://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Borderless_Networks/Unified_Access/BYOD_Design_Guide/BYOD_Wired.html

[kpeters011]

Thanks! This was helpful!

[Francesco Molino]

You're welcome!