Contractors receive a certificate error accessing the Cisco ISE guest portal but employees do not. What change allows both groups to access the portal without errors?

Contractors typically use personal devices not managed by the organization, meaning they don't trust the internal Certificate Authority (CA). When Cisco ISE presents a certificate signed by an internal CA, their devices will flag it as untrusted, causing a certificate error. Employees, however, have corporate devices that are configured to trust the internal CA, so they don't experience this issue. Installing a trusted third-party certificate (like from DigiCert or GlobalSign) on Cisco ISE resolves this. These certificates are signed by CAs that are universally trusted by most operating systems and browsers, eliminating the error for both contractors and employees without requiring any configuration changes on individual devices. Installing certificates on contractor devices is impractical and unscalable.