4

Our Root CA Certificate expired recently, in advance we loaded the new one on our ISE servers however after the expiry we have had issues with Android devices and BYOD onboarding.

Apple devices are working without issue and our 802.1x with workstations is also working without issues however Android devices are flagging the following error in the logs: "EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate"

We have tried removing the old certificate, restarted the PSN and ISE servers and forced a resync as well. Apple and Windows devices are showing the certificates are fine and NOT flagging the same error, they operate 100% of the time.

Note: All ISE certificates come from our enterprise CA

Has anyone encountered this issue before?

5
  • 1
    With Android devices, you can have multiple CA's (or chains) installed for RADIUS, but you can only point to one. Odds are you need to make a configuration change on the Android devices to point at the new CA, even if you have installed the new CA.
    – YLearn
    Jul 14, 2014 at 21:12
  • We removed all certificates from the user certificate store on Android and loaded the root CA. No luck, same error. Jul 14, 2014 at 21:15
  • What version of ISE are you running? Jul 14, 2014 at 23:04
  • We are currently running ISE 1.1.4 Jul 15, 2014 at 0:28
  • 1
    I have no evidence to bear on this specific problem; however ISE 1.1 is widely regarded as buggy and undesirable. Have you considered upgrading to ISE 1.2? Jul 15, 2014 at 11:50

2 Answers 2

2

I would recommend opening a TAC case. However, consider that with your root cert expiry, you may need to ensure you have uploaded your intermediary certs as well.

To be clear, your PAN should have the root and intermediary certs and your PSNs will send the entire chain. Do not catenate the certs together.

I have seen this error before and we were missing an intermediary chain. I would echo what Mike suggested and move to ISE 1.2 and realize the many other benefits/bugfixes.

3
  • I'm not so sure a TAC case would help. They would probably say it's a hardware problem seeings how every other device works just fine.
    – Ryan Foley
    Jul 16, 2014 at 17:07
  • 1
    TAC should help as android is a supported platform. They would review any policies you have to determine if behaviors were different for android devices based on profiling configurations and help you better understand the error. For support in this thread however, I would recommend posting the accounting/authentication details.
    – Silv
    Jul 16, 2014 at 18:12
  • Working through a case with TAC for the last week without a solution, will post details once resolved. Jul 17, 2014 at 7:59
2

In case this helps someone else I can confirm the problem was ultimately resolved by forcing a manual Sync of the PSN, no other changes were required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.