ise certificate validation failed in log

[Abreey]

hello cisco community,

I have problem in eap tls and I searching the log in every device to solve the problem.

when I look to wlc, wlc generate log like this :

RADIUS server 10.175.4.71:1812 failed to respond to request (ID 79) for client f8:94:c2:1a:22:a5 / user 'bbb@aaa.com'

and in ISE generate some log, but there is significant log that I think the problem :

34151 WARN System-Management: Certificate Validation Failed, ConfigVersionId=109, AdminName=Unknown, OperationMessageText=Certificate Validation failed for host:ise.aaa.com, AcsInstance=ise.aaa.com,

and my question are :

1. is there any chance the eap-tls not success because certificate in ise (like log said, certificate validation is failed)??

2. I dont see any explanation about that log. would somebody care to explain what I must to do for fixing the log in ISE.

Thank you very much.

[Andrii Oliinyk]

hi

what do u have in authentication details for this endpoint? can u see 12321 "failed SSL/TLS"?

[Abreey]

thank you andy for respon,

there is no 12321 "failed SSL/TLS" in ise log.

like picture below, only code 5440 endpoint abandoned EAP session and started new.

I did tcpdump in ISE interface and there is no step 7 to 10 (like picture below) at my pcap file.

[Greg Gibbs · Accepted solution]

If the client supplicant is not sending its certificate chain in response to the server (ISE) certificate, it is likely not trusting the ISE EAP cert and terminating the EAP connection.

I would suggest reviewing the following documents and comparing to your environment:

Understand and configure EAP-TLS using WLC and ISE 

Configure EAP-TLS Authentication with ISE - Common Issues and Techniques to Troubleshoot 

There is also a similar Community post here that might provide some guidance. These certificate issues can be tricky to troubleshoot without experience, so you might need to open a TAC case to investigate further.

[Abreey]

Thank you Greg for the answer.

I will call TAC soon for investigate the wlc one. because I create lab with same ise and key chain in wired 802.1x environment it works like a charms.

Thank you so much!

[Aref Alsouqi]

How the endpoint's NIC is configured for dot1x?

[Abreey]

Hi Aref, thank you for reply,

like picture below, I configured endpoint nic using certificate's user. certificate's user deploy using GPO auto enroll and signed using ENT-CA. ENT-CA and ROOT-CA already in trusted certificates at ISE and endpoint.