When you register a secondary PAN node to your initial PRIMARY PAN node, then you are creating a deployment (ISE Cube). That has the built in effect that the Secondary PAN will be kept in sync with the Primary PAN.
The issue you're describing seems to be with the secondary PAN registration. If you don't have certificate trust between the two servers then the registration will fail.
The cleanest way to make this happen is to create Admin certs from a common PKI (e.g. your internal Windows CA Server). Then install the PKI CA cert chain on ALL of your ISE nodes. Then import the ISE Admin to each node (or if you created a CSR per node, then simply bind the cert from your PKI back to each node).
Then when you register node 02 to node 01, the node 01 will trust the cert of node 02 because the node 02 cert was issued by a CA that is in node 01's trust store.
Don't be tempted to import each other's ISE self-signed Admin cert - that's the quick and dirty (and lazy) approach.
.jpg "VIP Advisor"){kind=icon}
