Hello my customer would like to use their existing Wildcard Certificate *.theirdomain.com for the ISE Guest Portal.
So, I was going to use the URL: guest.theirdomain.com.
However after reading through the following article:
http://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20/b_ise_admin_guide_20_chapter_0111.html#concept_8ECCCAF1252E40DDB9A786C0AC7BC3B2
I note:
"If you use wildcard certificates, we strongly recommend that you partition your domain space for greater security. For example, instead of *.example.com, you can partition it as *.amer.example.com. If you do not partition your domain, it can lead to serious security issues"
The customer has since looked into using the SAN field in their wildcard certificate for the use of guest.ise.theirdomain.com but it is very expensive. The other possible option is for a single domain certificate for guest.ise.theirdomain.com which is much cheaper option.
However, can someone explain their "serious security issues", else I will just use guest.theirdomain.com which is the free option.
