My 4 node ISE deployment is working fine as a CA for cert based authz with anyconnect + ASA.
I cannot get SCEP working however.. whenever I try to configure one of my PSNs in my 'enroll' connection profile, i get an error complaining that there is a non resident Endpoint RA cert being presented along with the Endpoint sub CA cert (which is resident as i have installed it in the ASA's trusted cert store)
Problem is, i can't install the RA cert in the ASA, because it doesn't exist in ISE's CA cert list.. for any of my nodes. ISE is definately presentig this cert to the ASA as it's cn is for my PSN, and even has a serial number.. this is from the error message on the ASA (serial number removed):
NON-RESIDENT CERT: serial: [serial number], subject: cn=Certificate Services Endpoint RA - ISEPSN-01
So ISE has this cert somewhere, but where? I have looked through every cert store for that serial number, or anything that refers to RA - nothing.
thanks
