non-trust cert is shown ,when connect wfi (BYOD solution)

[cheungchunyu]

Hello,

We bought a cert for ISE.(EAP,  admin and default portal).We can check "validate server cert" now.But when we connect to the wifi,it show a non-trust cert.

I have two question.

1.What is that cert?

2.Anyway to let the client trust this cert(already buy a public cert)?

Duncan

[Andre Neethling]

Is this with all BYOD devices?

From 1.3, ISE has an integrated CA for BYOD. This CA's Root Certificate is self signed. This is most probably the cert you are not trusting.

[cheungchunyu]

Hello,

As I mention,we already import a system cert(not self-signed) in ISE.So I believe that mobile endpoint will not received any warning on cert.

If you said is correct,we need to buy another CA root cert for ise?

Duncan

[Andre Neethling]

The ISE CA is not trusted by any mobiles. The ISE generates a ROOT CA cert and then it issues a cert to the ISE Sub/Intermediate CA. This is the CA that issues certs for BYOD.

 The truted cert you bought is for the ISE system identification.

[cheungchunyu]

Hello,

Any way to solve this issue or prevent it happen again?

Duncan

[Andre Neethling]

Maybe you can add the ISE Sub CA and Root CA certs to the trusted certs of the mobiles. But I suspect this is not a viable option due to the fact that the mobiles are not under your control.

[cheungchunyu]

Hello,

I get your mean,but it is not acceptable in our environment .

I will double check that what cert is shown when connect to the wifi.

If you said is ture,I think I need open a support case for this issue.

As mobile device didnt expect recevie a cert when the device just connect the wifi.

Anyway,thank you for your idea.

Duncan

[cheungchunyu]

hello,

I double checked ,the showing cert is EAP cert.

We only find the apple devices will showing this untrust cert.

It is a apple device issue.

This is an Apple (iOS) issue. I have raised question in the discussion forum (along with many other users having the same issue)

https://discussions.apple.com/message/23391267#23391267

Other discussions regarding the same issue:

https://discussions.apple.com/message/21869722#21869722

https://discussions.apple.com/message/20237323#20237323

https://discussions.apple.com/message/20338508#20338508

Duncan