Our Root CA Certificate expired recently, in advance we loaded the new one on our ISE servers however after the expiry we have had issues with Android devices and BYOD onboarding.

Apple devices are working without issue and our 802.1x with workstations is also working without issues however Android devices are flagging the following error in the logs: "EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate"

We have tried removing the old certificate, restarted the PSN and ISE servers and forced a resync as well. Apple and Windows devices are showing the certificates are fine and NOT flagging the same error, they operate 100% of the time.

Note: All ISE certificates come from our enterprise CA

Has anyone encountered this issue before?

  • 1
    With Android devices, you can have multiple CA's (or chains) installed for RADIUS, but you can only point to one. Odds are you need to make a configuration change on the Android devices to point at the new CA, even if you have installed the new CA. – YLearn Jul 14 '14 at 21:12
  • We removed all certificates from the user certificate store on Android and loaded the root CA. No luck, same error. – ServerMonkey Jul 14 '14 at 21:15
  • What version of ISE are you running? – This Jul 14 '14 at 23:04
  • We are currently running ISE 1.1.4 – ServerMonkey Jul 15 '14 at 0:28
  • 1
    I have no evidence to bear on this specific problem; however ISE 1.1 is widely regarded as buggy and undesirable. Have you considered upgrading to ISE 1.2? – This Jul 15 '14 at 11:50

I would recommend opening a TAC case. However, consider that with your root cert expiry, you may need to ensure you have uploaded your intermediary certs as well.

To be clear, your PAN should have the root and intermediary certs and your PSNs will send the entire chain. Do not catenate the certs together.

I have seen this error before and we were missing an intermediary chain. I would echo what Mike suggested and move to ISE 1.2 and realize the many other benefits/bugfixes.

  • I'm not so sure a TAC case would help. They would probably say it's a hardware problem seeings how every other device works just fine. – Ryan Foley Jul 16 '14 at 17:07
  • 1
    TAC should help as android is a supported platform. They would review any policies you have to determine if behaviors were different for android devices based on profiling configurations and help you better understand the error. For support in this thread however, I would recommend posting the accounting/authentication details. – Silv Jul 16 '14 at 18:12
  • Working through a case with TAC for the last week without a solution, will post details once resolved. – ServerMonkey Jul 17 '14 at 7:59

In case this helps someone else I can confirm the problem was ultimately resolved by forcing a manual Sync of the PSN, no other changes were required.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.