Need information on certificate in cisco ISE

[pcno]

Hi all, I want to know what are all these certificate shows in certificate authority certificate.Why there is so many for each node and what is the purpose of this certificate.
When I look into an issued cert of a BYOD client I am seeing a certificate chain of PSN , PAN and a Internal root CA please check the attached image and please explain How each node is working as in the image PAN is involved in Issuing certificate I wonder what is the mystery of whole thing.

ISE01 is the PAN
ISE03 is the PSN
LAB is our CA 
Thanks
Priyesh

[Greg Gibbs · Accepted solution]

I suggest reviewing Aaron Woland's 2016 Berlin Cisco Live presentation for BRKSEC-3697 Advanced ISE Services, Tips & Tricks. He has an entire section on how the ISE Internal CA works for BYOD.

Cheers,

Greg