EAP-TLS is using for machine authentication with Cisco ISE and 802.1X. The root certificate that signed the client certificates is about to expire. I understand we can just add the new root certificate in the trusted store of the ISE servers, but how to handle this on the client side. Our customer is using Windows 7 PC''s and the certificate used for authentication is stored in the personal computer store. Is it possible i.e. to have two client certificates in that store and if so how can it be determined which certificate will be used for the EAP-TLS session?
