A university is starting BYOD onboarding for student laptops. The registration pages must open without any browser certificate warning, the certificates issued to endpoints must come from an ISE certificate template, and ISE must accept those endpoint certificates for EAP-TLS afterwards. Which certificate configuration satisfies all three requirements?
Select an answer to reveal the explanation.
Short Explanation
Your portal needs a trusted certificate that matches its URL, like a key that fits the right lock, while endpoint certificates must come from an ISE certificate template. ISE must also trust its internal CA to accept those certificates for EAP-TLS.
Full Explanation
These requirements involve the portal’s HTTPS certificate and the certificates issued to endpoints. The portal needs a certificate issued by a CA trusted by the students’ browsers, with a name matching the registration URL; a self-signed certificate or a name mismatch can cause a browser warning. ISE certificate templates define the endpoint certificates issued by the ISE internal CA. ISE automatically trusts its internal CA certificates, allowing it to validate certificates that its internal CA issues for EAP-TLS. Certificates issued by an external CA may require that CA’s chain to be added to ISE’s Trusted Certificates store with the appropriate trust settings. Practical check: open the portal from a device with a fresh profile and confirm that the browser reports no certificate warning.