A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal is also used by employees. A solution is implemented, but contractors receive a certificate err

Installing an Internal CA signed certificate on Cisco ISE would only work if the contractor devices are configured to trust that specific Internal CA, which is unlikely for personal devices.

Since employees can access the portal, their devices likely trust the internal CA (or the certificate is already publicly trusted for them), but contractors' personal devices do not trust the internal CA, necessitating a publicly trusted third-party certificate on the Cisco ISE to resolve the browser certificate error.

Installing an internal CA signed certificate on contractor devices is not scalable or practical, as it requires manual configuration on each contractor's personal device.

Certificates are installed on the server (Cisco ISE) to prove its identity to clients; installing a trusted third-party certificate on contractor devices would not resolve a certificate error originating from the server's untrusted certificate.