ISE Problem: EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain

[jrodriguez]

Hello, I´m stucked with this problem for 3 weeks now.

I´m not able to configure the EAP-TLS autentication.
In the "Certificate Store" of the ISE server I have Installed the Root, policy and the Issuing certificates as "trust for client authentication",and in the Local store I have a certificate issuing for the same issuing authority which sign the thw client ones.
The ISE´s certificate has been issued with the "server Authentication certificate" template.
The clients have installed the certificates  also the certificate chain.
When I try to authenticate the wireless clients I allways get the same error: "     Authentication failed : 12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain"
and "OpenSSLErrorMessage=SSL alert
code=0x230=560 ; source=local ; type=fatal ; message="Unknown CA - error self-signed certificate in chain",OpenSSLErrorStack=  1208556432:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2720"
I don´t know what else can I do.

Thank you
Jorge

[aravikumar]

Hello,

Thanks for your response. we have a mdm onboarded iphone which is configured for EAP-TLS. we are getting this error even though the options you mentioned are enabled for CA. 

we are getting this error "EAP-TLS failed SSL/TLS handshake after a client alert"

Thanks,

Aravind.