ISE Identity Certificate.

Question

Hi there,
Does anyone have any experience with Publicly signed ID certificates for ISE.
We are going to be deploying Guest Services via CWA. When a user connects to the portal they get a certificate error as the current ID certificates are only signed by our internal CA and nobody but internal users will have that CA installed.
I went to an external provider (Geotrust) and wanted to get a Public CA signed Certificate with the CN = guestportal.company.com and SAN fields of internalserver.company.local.lcl, Private IP of BOX and External IP of Box. I get this Error from Geotrust.
Certificates that expire      after November 1st, 2015 may not contain an internal server IP address or      server name. Please modify SAN entry to continue.
Researching further into this it seems that all Certificates being issued by Public CA’s need to abide by the following new rules.
“What is an Internal Name?
An internal name is a domain or IP address that is part of a private network. Common examples of internal names are:
    Any server name with a non-public domain name suffix. For example, www.contoso.local or server1.contoso.internal.
    NetBIOS names or short hostnames, anything without a public domain. For example, Web1, ExchCAS1, or Frodo.
    Any IPv4 address in the RFC 1918 range.
    Any IPv6 address in the RFC 4193 range.”
Has anyone got around this? Or will the guests just have to put up with the Certificate error? Also I'll have to change the PSN's hostname to the CN which has implications for it joining our internal active directory so not keen on that.
I've ready that LDAP might be my only solution which I am not really keen on see below.
https://supportforums.cisco.com/docs/DOC-37562

Answer 1

I have run into he same situation with public CAs. I need two separate certs, a public https one and an internal EAP one, each on a different domain. Is this possible? if so how do you generate the certs for two different domains? The public one is straight ford as it will have the correct domain on configure on the ISE node. However for the EAP cert how will an internal PKI react to a CSR generated by a box on a different domain?
Recently I had a conversation with the TAC engineer. And the outcome seemed positive. The outcome from that conversation was the following:
- Https wild card certificate from Public issuer with example.org.au 
- CLI change on ISE nodes to change their domain to org.au
- The company DNS must be able to resolve the ISE FQDN node names with example.org.au. For example - ISE01.example.org.au. 
- The EAP certificate can be issued from the legacy Corporate PKI with a domain of example.local
However in a response to the same question the account team have said:
In response to checking if ISE can deployed with multiple domain certificates such as for http management on example.org and EAP on example.internal.org
The reason why this is not possible is because for installing a certificate in ISE you need to pass few conditions - 
"Cisco ISE checks for a matching subject name as follows:
1.Cisco ISE looks at the subject alternative name (SAN) extension of the certificate. If the SAN contains one or more DNS names, then one of the DNS names must match the FQDN of the Cisco ISE node. If a wildcard certificate is used, then the wildcard domain name must match the domain in the Cisco ISE node’s FQDN.
2.If there are no DNS names in the SAN, or if the SAN is missing entirely, then the Common Name (CN) in the Subject field of the certificate or the wildcard domain in the Subject field of the certificate must match the FQDN of the node.
3.If no match is found, the certificate is rejected."