We're migrating ISE 2.4 to ISE 3.3 by running in parallel by adding new 3715's. Then, we'll just cut over. Certificates deployed as you specified - access.ise.domain.com and *.ise.domain.com. We've got CIMC and G0 primary | G1 backup interface for GUI mgmt on the PAN/MnT on 3615s. The 3715s will be PSN dedicated in a Medium deployment. We're leveraging the 10Gbps capability of fiber on the boxes. Will the certificate delivery work fine for RADIUS, AAA, portal services over the 10Gbps interfaces on fiber?