4

Our Root CA Certificate expired recently, in advance we loaded the new one on our ISE servers however after the expiry we have had issues with Android devices and BYOD onboarding.

Apple devices are working without issue and our 802.1x with workstations is also working without issues however Android devices are flagging the following error in the logs: "EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate"

We have tried removing the old certificate, restarted the PSN and ISE servers and forced a resync as well. Apple and Windows devices are showing the certificates are fine and NOT flagging the same error, they operate 100% of the time.

Note: All ISE certificates come from our enterprise CA

Has anyone encountered this issue before?

Improve this question
5
  • 1
    With Android devices, you can have multiple CA's (or chains) installed for RADIUS, but you can only point to one. Odds are you need to make a configuration change on the Android devices to point at the new CA, even if you have installed the new CA.
    – YLearn
    Jul 14, 2014 at 21:12
  • We removed all certificates from the user certificate store on Android and loaded the root CA. No luck, same error.
    – ServerMonkey
    Jul 14, 2014 at 21:15
  • What version of ISE are you running?
    – Mike Pennington
    Jul 14, 2014 at 23:04
  • We are currently running ISE 1.1.4
    – ServerMonkey
    Jul 15, 2014 at 0:28
  • 1
    I have no evidence to bear on this specific problem; however ISE 1.1 is widely regarded as buggy and undesirable. Have you considered upgrading to ISE 1.2?
    – Mike Pennington
    Jul 15, 2014 at 11:50

2 Answers 2

Reset to default
2

I would recommend opening a TAC case. However, consider that with your root cert expiry, you may need to ensure you have uploaded your intermediary certs as well.

To be clear, your PAN should have the root and intermediary certs and your PSNs will send the entire chain. Do not catenate the certs together.

I have seen this error before and we were missing an intermediary chain. I would echo what Mike suggested and move to ISE 1.2 and realize the many other benefits/bugfixes.

Improve this answer
3
  • I'm not so sure a TAC case would help. They would probably say it's a hardware problem seeings how every other device works just fine.
    – Ryan Foley
    Jul 16, 2014 at 17:07
  • 1
    TAC should help as android is a supported platform. They would review any policies you have to determine if behaviors were different for android devices based on profiling configurations and help you better understand the error. For support in this thread however, I would recommend posting the accounting/authentication details.
    – Silv
    Jul 16, 2014 at 18:12
  • Working through a case with TAC for the last week without a solution, will post details once resolved.
    – ServerMonkey
    Jul 17, 2014 at 7:59
2

In case this helps someone else I can confirm the problem was ultimately resolved by forcing a manual Sync of the PSN, no other changes were required.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.