Contractors get a certificate error accessing the ISE guest/employee portal while employees do not. What change allows both contractors and employees to access the portal without errors?

Contractors experience certificate errors because their devices do not trust the Certificate Authority (CA) that signed the Cisco ISE's certificate. Employees likely have the internal CA's root certificate installed on their devices, allowing them to trust it. Installing a trusted third-party certificate (e.g., from DigiCert, Sectigo) on the Cisco ISE is the correct solution because these CAs are universally trusted by most operating systems and browsers by default. This eliminates the need to manually install certificates on contractor devices or for contractors to configure trust settings, providing seamless access for all users. Installing an internal CA certificate on ISE would still require contractor devices to trust that internal CA. Installing certificates on contractor devices is impractical and unscalable.