Rejected ACS local-certificate with surrogate CA

[JPavonM]

I'm going crazy because of clients rejecting ACS certificate.

I have deployed successfully one ACS 5.2 in a HQ with EAP-TLS and PEAP and everything is working fine. There is only one main CA.

Problem is while deploying another ACS 5.2 against another AD with surrogate CAs. I'm getting an error with "12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ACS local-certificate". The clients has the ACS self signed certificate loaded as well as the surrogate CA and the user certificate.

Any suggestion would be appreciated.

[Tarik Admani]

Jesus,

Are you saying that the ACS cert is signed or is it a self signed certificate?

Thanks,

Tarik Admani
*Please rate helpful posts*

[JPavonM]

We have generated a certificate in ACS and it has been signed by the CA.

Then, in Certification authorities we have added both ACS signed certificate and CA certificate (trusted for EAP clients) with its corresponding CRL.