An organization is setting up a ClearPass server for their network authentication. The administrator has installed a certificate issued by an internal Certificate Authority. The clients cannot fully validate the server's certificate. What additional step must the administrator take to ensure the clients can successfully validate the certificate?

This is a standard Public Key Infrastructure (PKI) trust issue. When a server presents a certificate, the client validates it by checking the signature chain up to a trusted root Certificate Authority (CA). Certificates from internal CAs are not trusted by default because the internal root CA is not in the client's public trusted root store. To establish trust, the root certificate of the internal CA must be installed on each client device. This allows the client to validate the entire certificate chain and trust the ClearPass server.

A. Disable the trust check in the client's validation process: This is extremely insecure as it would make clients vulnerable to man-in-the-middle attacks by accepting any certificate.
C. Reissue the certificate from a public Certificate Authority: This is a valid alternative strategy but does not solve the problem using the existing internal CA, which is the implied context of the question.

1. Aruba ClearPass Policy Manager 6.7 Hardening Guide, Page 10, "Certificates > HTTPS Certificate". The guide states, "For clients to trust the server, the CA that signed the server certificate must be present in the clients’ trust list."

2. Aruba ClearPass Deployment Guide, Version 6.7, Page 38, "Installing the HTTPS Server Certificate". The guide explains the need for clients to trust the CA that issued the ClearPass HTTPS certificate for functions like OnGuard and Onboarding.