How to push ISE portal certificate (posture) to Anyconnect clients?

[Larry Sullivan]

Hi,

Anyconnect client isn't trusting the ISE certificate for posturing upon connection due to it being a self signed certificate.

I have tried certificate pinning in VPN editor but that made it so I get an error upon connection saying can't connect at all due to pinning issue/error.

I tried manually loading the ISE certificate in my trusted store but it was in PEM format and apparently that is not one of the accepted formats.

What is the best and most user friendly way to get Anyconnect clients to trust the certificate?  Is there a way to get the FTD to tell the client to trust the certificate via the VPN profile or to force the client to install it without user interaction? 

[Rob Ingram]

@Larry Sullivan te easiest way would be to use a publically signed certificate on ISE, which most devices will automatically trust as the root cert is already in the certificate store.

[Larry Sullivan]

Yeah wanted to avoid that option, but if worst comes to worst may have to go that route.