Public wildcard certificate

[Madura Malwatte]

I currently have a private wildcard certificate installed on my ise deployment for use for admin, eap auth and portals. Its SAN is *.ise.company.com. However I am in the process of getting a public certificate for the portals (guest hotspot, sponsor, my devices, cwa, etc). Could this be just a single wildcard public certificate for use of all the different portals? What would the CN be for the public cert (same as the private wildcard cert? would this cause issues?).

would i have the private wildcard usage ticked for just EAP authentication, and the public wildcard for admin and all other portals?

I also have a psn in the dmz (used just for guest portal). would I need to separate out the public wildcard into two certs, one cert being for just the guest portal which will be imported only into the dmz psn? while the internal psn's would have the other wildcard public cert for remaining portals?

[pan]

One wildcard certificate can be used for portals.

For EAP you should use internal wildcard certificate otherwise EAP-TLS will fail.

[Arne Bier]

Just to second what @pan said, the EAP cert can be a wildcard cert (preferably internal PKI) but ensure that the certificate's Subject does NOT contain the wildcard!!! It will break Windows supplicants because Microsoft does not support Wildcards in the Subject.  You must put the wildcard in the SAN instead (DNS:  *.mycompany.com) - the Subject Common Name is largely irrelevant in this case - you can make it megacorp.mycompany.com - call it anything, as long as you don't put a wildcard in there :-)

[Madura Malwatte]

does this apply for the public wildcard cert too? I have already an internal wildcard certificate working fine.

for the public one, would the format be identical to my internal wildcard? i.e:

CN: ise.company.com

SAN DNS: ise.company.com, *.ise.company.com

or can I just utilize as below since there is no restriction like the internal wildcard where windows supplicant does not a wildcard in the CN? i.e:

CN: *.ise.company.com

[pan · Accepted solution]

The restriction is only for cert used for EAP.

[Madura Malwatte]

Excellent thats what i thought. Thanks for confirming.