Hi,
I'm trying to preempt a change of EAP certificate as part of an ISE upgrade we are undertaking and having problems with certificate trust on Apple devices. We are using a Microsoft CA infrastructure with an offline root and online sub-CA. Previously, when the EAP certificate was due to expire we've created a CSR on ISE, signed the cert and pushed it out to devices from our MDM in advance. However, the devices have both the root and sub-CA public certs installed so in my head this step isn't necessary.
To test it, we've built a new device, installed the root and sub-CA certs out with Apple Configurator and as soon as we try to join the SSID with the username/password, we get presented with a prompt to trust the EAP cert. I wasn't sure if the issue is that the device receives the cert, matches the sub-CA cert but cannot reach the CDP/CRL it to verify whether the cert is revoked and so it then prompts the user?
I wondered if anyone else has got some ideas/experience? For info I have been referring to this Apple material: https://it-training.apple.com/tutorials/deployment/dm150/
Thanks,
Stuart
