Not sure if this is the right place to start on this. We have our WLC's integrated with ISE and AD. Our production ssid uses dot1x. We have roughly 15k windows domain devices and other various personal devices users bring in that seem to work fine. An issue started cropping up with Apple devices specifically. I want to say this started once IOS12 was released late last year but can't be 100% positive.
ISE passes the EAP cert through the controller to the client. Once you select the ssid and enter in the domain id and password the client prompts you to accept the certificate all as expected for the initial connection.
Two issues -
1. The cert prompt shows it has expired. If you tap the details to view the cert you can clearly see that the current date is passed the "valid after" date and is years before the "expires on" date, so the cert should not be considered expired. Once you trust the cert you connect and pass traffic as normal. This behavior is repeatable and consistent - if you forget and re-connect to the network the same thing happens.
I found an old apple ipad running ios 9 and it does the same thing described in #1. Android devices don't do this but they ignore the cert all together. Windows (both domain and non-domain) devices don't do this.
Once you trust the device and continue on, you will randomly get prompted to re-trust the cert. Sometimes it shows it's expired as described in #1, sometimes it doesn't... but you will eventually get prompted. It may be a day, or a week, but eventually the prompt to re-trust the previously trusted cert does come up.
I'm leaning towards it being an apple issue - it should never mark a valid cert expired and shouldn't prompt to re-trust something that already was. Just looking for any ideas or others experiences.
