https://supportforums.cisco.com/blog/9913621/using-open-source-dogtag-certificate-authority-ise-byod
I tinkered with this at work, but found it lacking from a production standpoint. This may be due in part to working outside my typical Debian-based comfort zone. Will probably look at it again at home and see if it shows more promise with experience.