A customer wants to provide wireless access to contractors using a guest portal on Cisco ISE. The portal Is also used by employees A solution is implemented, but contractors receive a certificate erro

Contractor devices, being external, likely do not trust the internal CA that signed the Cisco ISE certificate; installing a trusted third-party certificate on Cisco ISE ensures that both contractors' (external) and employees' (potentially internal CA trusted) devices will implicitly trust the portal's certificate.

Installing an internal CA signed certificate on *contractor devices* is impractical and insecure for guest access, as it would require manually configuring each contractor device.

An internal CA signed certificate on Cisco ISE is the likely *cause* of the contractor error because internal CAs are not typically trusted by default on external devices like contractor laptops.

Installing a trusted third-party certificate on *contractor devices* is unnecessary; the certificate for trust should be on the server (Cisco ISE) and trusted by the client devices.