Mobile device EAP-TLS onboarding ?

[tedauction]

Hello, I want to automatically on-board a wide variety of different cellphones i.e. iOS, Android, Windows phones.

I want users to initially connect to an unsecure 'onboarding' SSID and have their cellphone auto provisioned with a secure SSID i.e. EAP-TLS using a client certificate auto generated and installed on their cellphone along with the public certificate of our in-house self-signed root CA.

However, I understand that Android devices at least, prevent self-signed certificates from being easily installed in to their certificate stores thus my plan would fail.

Is anyone out there currently auto deploying an EAP-TLS SSID to a wide variety of different cellphone models ?

Thanks for any info ?

[Francesco Molino]

Hi

Yes on every single ise deployment, customers want byod features.
I use a public certificate (not wildcard) for portals and eap authentication (even if for eap, when radius presents its public cert, most devices aren't trusting it). I, then, set ISE as subca for corporate pki (to avoid scep issues with customers pki. For few, we use their own windows pki srv with scep) to deliver clients certificates.
It works well.
Few tip though:
- in the middle of the process, on IOS, you need to manually go into settings and toggle the button to trust the radius cert otherwise the process fails.
- on some android (not the common vendor phones), sometimes, you need to ask users to download CNA before the enrollment process because during the process they're not able to download the app (even if acls are correct).

I'm doing byod with Cisco wlc, meraki and some 3rd party vendors.

[Jurgens L · Accepted solution]

Did a deployment a year back for Andriod version 4, 5 & 6, provided you keep you ISE patches up to date to keep up with the newer devices when it comes to onboarding, it went well.

Send you a private message of videos I created of the process end to end.