I am more so thinking of a case where the ISE deployment was deployed with a public domain (ex: mydomain.com), but the customer wants to use their internal CA for EAP. So i would be requesting EAP certificates with a CN of PSN1.mydomain.com but on a ...

For step #4 - What do you use for the CN and SAN fields when generating the CSR?