Configuring Certificates for BYOD in Cisco ISE
Configure certificates for BYOD
Answer
Correct answer: C — An endpoint certificate is mandatory for the Cisco ISE BYOD.
What should be considered when configuring certificates for BYOD?
Community Insight
The exam tests the fundamental prerequisite for certificate-based BYOD: the existence of a valid endpoint certificate. A common trap is confusing optional protocol details with mandatory security requirements.
This question addresses certificate configuration requirements for BYOD, specifically focusing on the mandatory nature of endpoint certificates and the fields used within them. The page clarifies that while enrollment protocols vary, a valid certificate is strictly required for authentication.
Candidates often select option D because Android devices do use EST (Enrollment Status Protocol) while others might use SCEP. However, this is a technical detail of implementation rather than a universal constraint or requirement for the BYOD feature itself, making it less correct than the mandatory nature of the certificate.
Community Discussion (25 comments)
Cname
👍 1
Selected: D
Cisco ISE BYOD uses EST for Android certificate enrollment, while other supported platforms use SCEP. Endpoint certificates are not mandatory for every BYOD deployment. Since Cisco ISE 2.2+, the Android Network Setup Assistant (NSA) app explicitly switched to EST (Enrollment over Secure Transport) on TCP port 8084 for downloading client certificates, whereas iOS, macOS, and Windows rely on SCEP.
817042b
👍 2
Selected: B
For device certificates in BYOD, it's standard to populate the Common Name (CN) with the host name of the device. This helps with identification and tracking of the device in the network. Cisco ISE commonly uses this format during certificate enrollment.
diverjim64
👍 1
Selected: C
see my reply to Cachaman below.
Cachaman
👍 3
Selected: C
Correct answer is C. This question is very specific: "BYOD with Certificates" When Cisco ISE is configured to use certificates for BYOD authentication, the endpoint must have a valid certificate.
diverjim64
👍 1
Agree. I just ran this scenario in a lab and Cert configuration (and adding it to a wireless profile under the Cisco-ISE-NSP provisioning resources) is a requirement. B and D also seem correct but I think they're looking for a "cert centric" answer here due to the question wording.
327c7c8
👍 1
Selected: B
actually B and D is correct
NikoTomas
👍 1
So correct will be D: "In ISE 2.2 (when using the Network Setup Assistant app version 2.2.X and Android version 6.0, 7.0 or newer) during the onboarding process, the Android device will make a certificate request directly to the ISE-server using the Enrollment over Secure Transport (EST) protocol. Due to this change, the firewall port that has to be open between the Android device and the ISE-server has changed as well to port TCP 8084." https://www.wiresandwi.fi/blog/android-byod-ise-22-changes I haven't found any mention of EST support on iOS, just SCEP.
NikoTomas
👍 1
According to CiscoPress SISE ebook, BYOD: --- For Android: "The NSP portal displays the device registration page with the Device ID field prepopulated with the MAC address of the endpoint." - you can see this also in the video at time 4:20: https://youtu.be/z0sRiffVdpg?t=264 - For Apple iOS, there are 2 certificates in the BYOD flow: 1. Device Enrollment ■ CN=device-UDID ■ SAN=MAC-Address --- 2. Device Provisioning ■ CN=Username ■ SAN=MAC-Address --- UDID is NOT hostname, just some numeric value and exists only for Apple. UDID according to Cisco is: "UDID Value. Match based on Unique Device Identifier (Apple specific)" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 - Example of UDID (it is just number): https://messapps.com/allcategories/development/finding-ios-devices-udid-via-itunes-2/ --- (continuation in comment)
NikoTomas
👍 1
Even thought CN can be MAC address (Device ID) in case of Android, this is NOT true for Apple iOS. So B (hostname in CN) is NOT correct according to me. See issued BYOD certificates here (screenshot in the section Manage issued certificates): https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867#toc-hId-2093653871 --- Endpoint certificate is NOT mandatory for BYOD. "While ISE supports various EAP types for 802.1X authentication, with ISE BYOD, there are three EAP Types that can be used; EAP-TLS, EAP-PEAP-MSCHAPv2, and EAP-FAST" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867 --- (continuation in comment)
XBfoundX
👍 1
remember that the host domain name is the hostname of that device. For example if the name of your computer is PIPPO and you will join to the AD cisco.com the FQDN / CN will be PIPPO.cisco.com
XBfoundX
👍 1
The Common Name (CN), also known as the Fully Qualified Domain Name (FQDN), is the characteristic value within a Distinguished Name (DN). Typically, it is composed of Host Domain Name and looks like, "www.digicert.com" or "digicert.com"
XBfoundX
👍 2
The answer here is B. The CN field have the FQDN of the the local computer, hostname + domain. The D answer is not bad but is saying that Android use EST for certificate enrollment while the other vendors uses SCEP, I mean IT CAN BE USED, BUT IS NOT MANDATORY other vendors will use different protocols also for the certificate enrollments. The B answer shoul be true because actually the CN field contain the hostname of the device.
XBfoundX
👍 1
Windows for example have also this protocol: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/446a0fca-7f27-4436-965d-191635518466
thol119
👍 3
Selected: D
CN is locked to $username$ SAN is locked to either MAC or MAC+GUID. Android devices do in fact use EST for cert enrollment, so i think D is correct.
CCNP21
👍 2
Selected: B
I vote for B.
TomMarvolo
👍 3
Selected: B
It should be B. When configuring certificates for Bring Your Own Device (BYOD), it is important to consider populating the CN (Common Name) field with the endpoint host name. The CN field should contain the host name or FQDN (Fully Qualified Domain Name) of the endpoint device. This allows the certificate to be properly validated when the device connects to the network. The CN field helps ensure that the device is correctly identified and authorized for network access.
rhylos
👍 2
WHat about D? https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine-software/116068-configure-product-00.html I am thinking D. Android uses EST and other OS uses SCEP
rhylos
👍 2
Selected: B
A is wrong. SAN can have MAC address, not Username Must Be B
rhylos
👍 1
Alternative Name (SAN) Currently, only value available is the MAC Address. The MAC Address is pulled from the RADIUS session from the endpoint that initiated the BYOD flow. This is one way ISE allows admin user to tie the certificate to the actual endpoint that it was signed for.
matan24
👍 1
Selected: B
i would go with B, "CN is auto populated with the username that is going through the BYOD flow. Other attributes can be entered here to reflect the site. If differentiating different endpoint or users based on certificate is needed, then any of the attributes here can be changed and can be used during AuthZ to provide differentiated access. For instance if OU=HR, the endpoint can have access to HR resources, while other endpoints cannot access HR resources" https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867
Hereim
👍 3
As per the https://community.cisco.com/t5/security-knowledge-base/cisco-ise-byod-prescriptive-deployment-guide/ta-p/3641867, it should be B. CN is populated with username. SAN can only have MAC address.
Russ
👍 1
MacOS and Windows devices: Employee clicks Register in the BYOD portal to download and install the supplicant provisioning wizard (Network Setup Assistant), which configures the supplicant and provides the certificate (if necessary) used for EAP-TLS certificate-based authentication. The issued certificate is embedded with the device's MAC address and employee's username.
kornalt
👍 2
So A is the right answer. C is not right. Certificates are not mandatory. You can also use a preshared key or username password combination.
kthekillerc
👍 3
Provided answer is correct
Cisco_SecCol_111
👍 1
Correct answer is might be A or C. Device Encrollment CSR is: SAN = Username CN = Device-UDID User CSR is: SAN = MAC Address CN = Username Any thoughts which is better?
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because Cisco ISE's BYOD functionality, when configured to use certificates for authentication, fundamentally requires the endpoint device to possess a valid digital certificate. Without this certificate, the device cannot authenticate via the certificate-based method, rendering the configuration useless. This is a core security principle of PKI-based access.Why the Other Options Are Wrong
Option A is incorrect because the Subject Alternative Name (SAN) field typically contains the MAC address or MAC+GUID, not the user name. Option B is incorrect because the Common Name (CN) is usually populated with the username or identity, not the endpoint host name, to align with identity management policies. Option D is incorrect because while Android often uses EST, it is not a strict rule that 'other operating systems' exclusively use SCEP; modern implementations can support various protocols, and more importantly, the protocol choice is secondary to the mandatory presence of the certificate itself.Community Comment Notes
Several community members initially debated between B and D. One commenter noted that 'CN is locked to $username$ SAN is locked to either MAC or MAC+GUID,' supporting why B is wrong. Another pointed out that 'Android devices do in fact use EST... so i think D is correct,' highlighting the distractor. However, the consensus shifted towards C as the definitive requirement. As one user succinctly stated, 'When Cisco ISE is configured to use certificates for BYOD authentication, the endpoint must have a valid certificate.'Official Reference
Exam Strategy
Focus on the 'must-haves' for each feature. When asked about configuration prerequisites, look for the absolute requirement (like a certificate existing) over specific implementation details (like which protocol is used), unless the question specifies a particular OS environment.
Frequently Asked Questions
Why is option D incorrect regarding Android and SCEP?
While Android often uses EST, other OS versions or configurations may also support it. More importantly, the protocol is an implementation detail, whereas having a certificate is a mandatory security requirement.
What fields should CN and SAN contain in BYOD certificates?
Typically, the CN contains the username or identity, and the SAN contains the MAC address or MAC+GUID to uniquely identify the device.