Third-Party Switch MAC-Auth Storm After Certificate Expiry
A campus uses ClearPass for 802.1X on Aruba APs and MAC authentication on third-party switches. The ClearPass HTTPS/portal certificate expires. Symptoms: (a) Aruba wireless 802.1X users continue to authenticate successfully; (b) third-party switch MAC-auth endpoints intermittently fail and retry, generating a burst of rejects; (c) guest captive portal shows certificate warnings. No configuration changed. RADIUS shared secrets are unchanged. The certificate is used for the web portal and for the OnGuard/HTTPS service.
1. Why do Aruba 802.1X users keep working while third-party MAC-auth endpoints fail?
Read the worked answer
The expired certificate affects HTTPS/portal and OnGuard services, not RADIUS. Aruba 802.1X is pure RADIUS (UDP 1812), which does not depend on the web certificate - so those users are unaffected.
Third-party switch MAC-auth failures are more subtle: MAC authentication itself is RADIUS, so a certificate alone shouldn't break it. The intermittent retries likely come from a different path - for example, switches using CoA/Disconnect or a web-based onboarding step, or endpoints falling back to a captive-portal/HTTPS flow that now fails cert validation. The burst of rejects suggests endpoints retrying a flow that touches HTTPS. The key discriminator: 802.1X over RADIUS is unaffected; anything traversing HTTPS (portal, OnGuard, provisioning) breaks.
2. What is the correct remediation sequence, and what should be verified afterward?
Read the worked answer
- Replace the certificate on the publisher (and subscriber if separately installed) with a valid cert whose SAN/CN matches the FQDN clients use.
- Distribute the new CA chain to endpoints and to any device that validates the portal/OnGuard cert, so trust is restored.
- Restart dependent services as required and confirm the new cert is active in Policy Manager.
Verify afterward: (a) guest portal loads without warnings, (b) OnGuard agents reconnect, (c) Access Tracker shows MAC-auth endpoints succeeding without retry storms, and (d) no residual rejects from endpoints caching the old cert. Then set a renewal reminder to prevent recurrence.