Connect. Secure. Manage.
Cisco ISE Certificate Authentication
Design EAP-TLS authentication with Cisco ISE, covering certificate trust, device enrolment, expiry handling and failed-authentication diagnosis.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco ISE certificate authentication uses a digital credential as part of network sign-in. We plan supported EAP-TLS access with the identity and endpoint teams. The work covers trust, issue, renewal and the response to a lost device. A sound certificate process and the right endpoint settings are both needed for the access rules to work.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Decide what the certificate represents
A machine certificate and a user certificate answer different questions. The first may establish that a managed device holds an approved credential. The second may identify a person using it. We agree the required identity at each stage, including pre-login access and situations where several people share one workstation.
That decision shapes the certificate profile and ISE policy. We check which certificate attributes will be used and whether an extra directory lookup is required for authorisation. A trusted issuer should not imply that every certificate from that issuer receives the same network access. The intended mapping must be narrow enough to distinguish the population actually authorised for the service.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Establish both sides of trust
The endpoint must check the authentication server, and ISE must check the presented client credential according to the chosen design. We review the relevant certificate chains, identities, validity periods and supported cryptographic settings. A missing intermediate certificate or an unexpected server name can prevent access even when the issuing authority itself is trusted.
We avoid asking users to resolve trust warnings by accepting whatever appears. Managed profiles should identify the intended service and distribute the necessary trust material through the customer's approved endpoint process. The project includes a check that a client refuses an inappropriate authentication server, not merely that it accepts the legitimate one.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Make enrolment part of the service
A certificate-based network needs a way to provision a device before it has ordinary network access. We map the enrolment route, required management network access and the team authorised to issue or approve certificates. New starters, replacement laptops and rebuilt devices are included in that process.
Private keys must remain protected under the endpoint design. We discuss exportability, device storage and admin access with the relevant owner rather than treating a certificate file as a harmless setup attachment. The proposal distinguishes work on ISE from work on the certificate authority and endpoint-management system. So that duties do not fall between teams.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Design renewal before the first expiry
Renewal is a routine operating need, not an exceptional incident. We agree who monitors validity, how replacement credentials reach devices and how long old and new trust chains may overlap during a planned change. A device that has been offline for months needs a recovery path that does not depend on an already expired network credential.
Changes to an issuing authority or authentication-server certificate can affect an entire estate. We prepare a staged transition and test representative clients before removing old trust. A successful certificate import into ISE does not prove that all endpoints recognise the new chain or that the intended certificate has been chosen for each service.
Define revocation and exception behaviour
The organisation needs an answer for a lost device, departing user or compromised credential. We review revocation mechanisms supported by the chosen release and the availability of the services used to check status. The agreed behaviour when those services are unavailable is a security and availability decision that must be recorded.
Revoking a credential and terminating an established network session are related but distinct actions. We test the intended response, including reauthentication and any supported session-change mechanism. The report explains what takes effect immediately and what depends on a later event, rather than implying that a certificate change instantaneously removes every current connection.
Test identity and permission together
The pilot includes valid, expired, untrusted and incorrectly identified credentials, and a device in the wrong authorisation group. We compare the ISE decision with the actual network access. A certificate may authenticate successfully while the later group mapping or enforcement result is incorrect.
We also test common operating events: reboot, sleep, user change and renewal. Evidence is recorded without exposing private keys or unnecessary personal data. Where a particular operating system or client version cannot support the intended workflow, the limitation is documented and a separate approach is agreed rather than concealed behind a permissive fallback.
Keep certificate access maintainable
MCI delivers the trust model, policy mapping, renewal duties and a practical fault-isolation procedure. This work can form part of Cisco ISE deployment or a focused conversion of a current password-based service. The aim is a network credential that is difficult to misuse and straightforward to operate, with ownership that continues after the initial certificate rollout.
Technical references
- Cisco ISE basic setup and certificate management — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.