ISE Profiler - Check certificate issuer value

[jif0x]

Hello all,

Is it possible to use the certificate "Issuer" value for profiling?

On the endpoints Attribute page, I see the following fields:

Issuer	CN=ExampleIssuingCA\,DC=example\,DC=local
Issuer - Common Name	ExampleIssuingCA
Issuer - Domain Component	example, local

What do I need to specify as Profiler Condition to reference that value?

[Arne Bier]

I don't believe you can construct a Profiler Rule that leverages Certificate attributes.

No option for that when building a Profiler Condtion

Another approach may be to simply perform the Cert checks in the Authorization, in combination with your existing Profiling Policies. Profiling is generally something that is gleaned prior to a TLS connection. 

[jif0x]

Thanks, Arne. I'll try to configure that.