@yukler - while all the responses in this thread are good to look at, looking at the logs of both ISE and a client that fails is often the best start to scope down the problem.
In ISE, you go to: Operations -> Radius -> Live Logs, and show the details for one of the failed wifi authentications.
The first focus should be the "Failure Reason", in most cases it's the best indicator.
And/or review the authentication flow on the right, to see at what point it is failing.
In most cases you should be able to narrow it down if this is an issue between WLC and ISE, or if this is a certificate issue, or a policy issue, etc, just by looking at those logs.
Another log that can be equally important, is the client log.
On a Microsoft Windows laptop, in the event viewer you can go to: Applications and Services Logs -> Microsoft -> Windows -> WLAN-AutoConfig, and view the "Operational" log.
If the issue is related to the client not being able to correctly validate the ISE server certificates, apart from the ISE log you should be able to see that clearly in the WLAN-AutConfig Operational log on the laptop.
If you find these logs and would be able to share with use the "Failure Reason" from the ISE log, the community might be quicker on isolating down to potential issues.
