Cisco ISE EAP Certificate Expired: show certificate When Every Laptop Fails Monday

Cisco ISE · Techclick CLI troubleshooting lab

Friday fine. Monday every 802.1X laptop fails. Helpdesk blames a Windows update.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

EAP server certificate often expires on a weekend. show certificate and Live Logs 'certificate rejected'.

Why this ticket shows up

Supplicants refuse an expired ISE EAP cert. It looks like a mass Windows failure because every laptop checks the date.

Symptoms operators actually see

• Mass fail after midnight Friday

• Live Log certificate error

• Browser to ISE portal also warns

• Guest SSID using the same cert

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show certificate
show certificate simple
show application status ise
show logging application ise-psc.log tail 20

How to read that output

If the EAP certificate Valid To is last Saturday, you have the outage. Windows update is a coincidence.

Triage order

1. Check certificate validity

2. Bind a new cert to EAP

3. Restart the affected ISE persona if required

4. Test one laptop

5. Watch Live Logs go green

Classic traps

What you see	Real cause	Fix
Uninstall Windows updates	ISE cert expired	Replace the cert
Rebuild the policy set	Every user fails the same way	That is identity/cert
Use a self-signed forever	Phones will still fail	Use a proper chain

Proof the ticket is closed

• New cert valid dates

• Laptop authenticates

• Portal has no warning

Say this in an interview

A Monday-morning mass 802.1X fail makes me check the EAP certificate dates before I touch Windows.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/