Hi everyone,
I'm working on implementing certificate-based authentication for pxGrid and running into some issues.
When I try to request the AccountCreate endpoint with client certificates, I get HTTP 503 Service Unavailable.
We haven't found any logs indicating an issue or traces of the request in the ISE logs, but we have performed a TCP dump and confirmed that the request is reaching the server.
Is there a different API flow for certificate-based vs password-based authentication?
Current Setup:
- ISE Version: 3.3.0.430
- pxGrid service is enabled and running
- Generated client certificates directly from the ISE pxGrid interface
In pxGrid Settings I have:
- "Automatically approve new certificate-based accounts" - enabled
- "Allow password-based account creation" - disabled (this is intentional)
What I've already checked:
- pxGrid service shows as running in the deployment page
- Port 8910 is listening and accessible
- The client certificates were generated from ISE itself
- I get the same 503 error even when disabling SSL verification completely, so it's not a certificate validation issue
- Password-based authentication works fine when I enable that setting
The 503 suggests the service isn't available, but everything runs normally. Is there something specific about the certificate-based flow that I'm missing?
Thanks
