WLC 5508   ISE - When using single SSID for BYOD from iPhone versions 12.x and onwards you need to apply config network web-auth captive-bypass enable on all your WLC's in order for the iPhone browser to be supported so supresses. That's a problem for me as Guest users with iPhones are no longer presented a login page.   Does anyone know if config network web-auth captive-bypass enable is supported on a per SSID basis? This would solve my issue!   Someone mentioned to me from WLC 8.4.x this option should be seen in the GUI not sure where or cmd line because @moment this command is a global command meaning all SSID's are enabled once the command is applied.   Thanks. ... View more

Hi Cisco community,   I've been working with a TAC Engineer for the last few days trying to sort my Android problem out (though I haven't tested Apple devices yet!)   I'm getting the same error explained in this document https://community.cisco.com/t5/security-documents/android-byod-provisioning-error-quot-certificate-generation/ta-p/3733734   Single SSID - Can login to BYOD successfully with Active Directory account Redirects me to BYOD portal, click start Register my Device successfully in Device Portal Run my Cisco CNA Proceed and Trust Certificate Network password is required, I enter my AD password same one as 1st step above "Certificate generation failed"   I'm running VE ISE 2.4 Patch 7 and NSA 2.2.0.55 With the TAC engineer we went over and over again changed configs in WLC ALC's, Authorization profiles, Policy Sets, Generated a New Self Signed Certificate with another Certificate Portal.........basically Engineer went through in detail from what I could see.   For some reason after following this document, we never see counter hits against these rules in our Policy sets, we have added the rule at the top added a separate policy set to see if this would work, still no hits. Note EST Service is running. The fact we cannot see any hits against these rules as suggested in this workaround doc means to me that we are missing something here.   Below are my Android SPW logs:   2019.04.15 20:43:01 INFO:EST Server =test.test.com 2019.04.15 20:43:01 INFO:EST Server port =8084 2019.04.15 20:43:01 INFO:ISEDownloadProfileAsynchTask.onPostExecute :PASSED 2019.04.15 20:43:04 INFO:Location Permission for the App is granted. 2019.04.15 20:43:13 INFO:Making SCEP call 2019.04.15 20:43:13 INFO:Generating RSA key with key size: 2048 2019.04.15 20:43:13 INFO:Going to call EST server with args: cn = ga2paen, un= ga2paen, sn= test.test.com, sp =8084, cur= P-384, ca_certs length = 4002 2019.04.15 20:43:13 INFO:Calling native logger init with : /storage/emulated/0/Download/estlog.txt 2019.04.15 20:43:13 INFO:SPW profile is having certificate parameters 2019.04.15 20:43:13 INFO:EnrollCert Native returned pem len = 16384 2019.04.15 20:43:13 ERROR:ISEEnrollmentAsynchTask 2019.04.15 20:43:13 ERROR:java.lang.NullPointerException: Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference 2019.04.15 20:43:13 ERROR:Attempt to invoke virtual method 'java.lang.String java.security.cert.X509Certificate.toString()' on a null object reference 2019.04.15 20:43:13 INFO:Internal system error.   Here are my Android EST logs:   ***EST [INFO][ossl_init_cert_store_from_raw:182]--> Adding cert to store (/CN=Certificate Services Endpoint Sub CA - sv195978) ***EST [INFO][ossl_init_cert_store_from_raw:182]--> Adding cert to store (/CN=Certificate Services Root CA - sv195978) ***EST [INFO][est_log_version:156]--> libest 1.1.0 (API level 3) ***EST [INFO][est_log_version:160]--> Compiled against CiscoSSL 1.0.1p.4.13 ***EST [INFO][est_log_version:161]--> Linking to CiscoSSL 1.0.1p.4.13 ***EST [WARNING][est_client_set_auth:3439]--> Not using client certificate for TLS session, HTTP basic or digest auth will be used. ***EST [INFO][cert_verify_cb:671]--> entering: Cert passed up from OpenSSL. error = 26 (unsupported certificate purpose)   ***EST [WARNING][cert_verify_cb:764]--> Certificate verify failed (reason = 26) (unsupported certificate purpose) ***EST [ERROR][est_client_connect:2245]--> Error connecting TLS context ***EST [WARNING][ossl_dump_ssl_errors:246]--> OSSL error: 3386898888:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:s3_clnt.c:1285:   Any ideas? Thanks ... View more