This is correct. I always add the sponsor portal's FQDN into the PAN's Admin System Certificate SAN. It seems to be an illogical thing to do, because the Admin cert is for admin stuff, right ... not guest/sponsor portals. But it's how ISE likes it. And luckily, we don't need a public signed cert for this - and internal signed cert from the organisation's internal CA is perfect for this role.
It's very unfortunate, and I think it's a bug/design flaw, that you cannot assign a Certificate Tag for the sponsor portal that uses its own certificate, which is independent of all other certificates (e.g. Admin, Guest Portals). You can configure it, but it won't work.
Therefore, I combine the Roles of "Admin, Portal" in one certificate, that has a Certificate Tag of "Sponsor Portal" which I use on the Sponsor Portal config page. The SAN of this internal PKI certificate includes the PAN FQDNs for admin, and also the CNAME for the Sponsor Portal. This allows me to browse to my PANs and to the Sponsor Portal CNAME (I use a CNAME that points to the A record of the currently active PSN - if this PSN were to fail, then I change the CNAME to point to another PSN's A record).
Guest portals have their own public cert and their own certificate tag as you would expect.
