popup prompt on client machine after EAP certificate renewal (eap-tls)

[devendran.raju]

We are using external CA signed certificate in ISE for admin, EAP, & portal (posture). We are planning to install renewed certificate in ISE as existing certificate is expiring soon.

We have renewed the new certificate with the same Common Name and signed by same external public CA to avoid any popup prompt on end user machine to trust the certificate. But in the renewed certificate, one of the intermediate certificate is changing (issuer CA) when we compare the certificate chain path. Other than 1 intermediate CA cert, all other certificates are same as old cert chain path.

Our question is whether any popup prompt to accept/trust new certificate is expected on the user machine during the wired / wireless eap-tls negotiation even though it is signby same external CA authority?

Existing Certificate's certificate path:
nac.ISE certificate >> Trusted Secure Certificate Authority 5 >> USERTrust RSA Certification Authority >> AAA Certificate Services

New Certificate's certificate path:
nac.ISE certificate >> Corporation Service Company RSA OV SSL CA >> USERTrust RSA Certification Authority >> AAA Certificate Services

[andrewswanson]

Hi

Have a look at the following blog on "alternate trust paths (or chains)". This may explain some of the behaviour that you are seeing with some clients.

https://scotthelme.co.uk/building-certificate-chains/

some details on AAA specifically are here:

https://www.tbs-certificates.co.uk/FAQ/en/racine-USERTrustRSACertificationAuthority.html

hth
Andy

[andrewswanson]

Just to clarify my last post - my understanding of Alternate Certificate Paths and the AAA CA is below.

• Do you have the top "path" (AAA as root CA) in ISE Trusted Certificates?
• If so, are your 802.1x supplicants configured to verify server identity (Using AAA root CA)?

Windows clients use the bottom "path" (USERTrust as root CA) so I was thinking that you may have got the certificate popup due to the supplicants verifying the ISE EAP certificate using the wrong root CA.

hth
Andy