A fintech firm rolls out BYOD with EAP-TLS, and every laptop receives a certificate from the corporate issuing CA during registration. The supplicants accept ISE's server certificate, but ISE rejects the laptop certificates as untrusted. Which trust relationship must ISE hold to validate the endpoint certificates?
Select an answer to reveal the explanation.
Short Explanation
You need to add the corporate issuing CA to ISE’s trusted certificates and enable it for client authentication—like giving ISE the official badge checker’s credentials. Your supplicants trusting ISE’s certificate doesn’t make ISE trust the laptops’ certificates.
Full Explanation
ISE is the EAP-TLS verifier, so it must be able to build and trust the laptop’s certificate path: from the endpoint’s leaf certificate through any intermediates to a CA in ISE’s trusted certificates store. Add the corporate issuing CA to that store and enable it for client authentication, allowing ISE to use it when validating endpoint certificates. Server-authentication-only trust fails because the CA is not enabled for the client-certificate validation role ISE needs. Supplicant-side trust addresses the reverse direction: it lets laptops validate ISE’s server certificate chain, but does not establish trust for ISE to validate laptop certificates. Full-chain transmission can supply intermediate certificates, but sending a chain does not make its CA trusted; ISE still needs an appropriate trusted CA. Exam caveat: distinguish the two directions of EAP-TLS trust and check the CA’s enabled usage, rather than assuming that trust on either device works both ways. Practical check: review ISE EAP live logs for certificate-chain validation failures and confirm that the corporate issuing CA is present and enabled for client authentication.