A camera or printer is still refused after I allowed older TLS. What now?

If a device is still refused after you allowed older TLS for its site, the TLS version isn't the problem any more. The type of signature on Passbeam's certificate is.

Passbeam signs its certificates with elliptic-curve signatures, which nearly everything supports. Some older equipment can only do RSA, so it can't check an elliptic-curve signature. The device gets to the end of the certificate exchange and gives up without saying why. The authentication log shows this: it says the device asked to restart instead of continuing, which usually means it couldn't use the certificate Passbeam sent.

The fix is an appliance certificate authority. It's a second authority for that client, all RSA, used only to sign the certificate those devices are shown. On the client's Certificates tab, open Appliances and press Add an appliance. Open the section called “This device still won't authenticate”, choose Create an appliance authority for this client, then Download the appliance root CA. Install that root on the device instead of the usual one.

Only install it on the devices that need it. A device can't tell Passbeam which root it trusts. Passbeam picks which certificate to show from the cipher suites the device offers. So a device that can do elliptic curve is always shown the usual certificate, and if the appliance root is the only one it has, it's refused. Don't roll this out across a site. Install it on the device that had the problem, and leave everything else on the usual root.

Two things don't change. The device's own certificate stays as it is and doesn't need reissuing, and appliances you've already added keep theirs. And most appliances never need this. One old printer might, while an equally old one next to it doesn't. It depends on that device's 802.1X software, not on its age.