Odd imC RADIUS and Apple IoS behavior

[NeilR]

I've migrated ImC from server 2008r2 to 2012r2 as part of my upgrade to 7.2

1st step was install 7.1 and restore the DB from the 2008 server

I use a backup imc server to provide a secondary RADIUS server for failover on both my switches and MSM for user port and wifi authentication. The autobackup and restore keeps the backup in sync with the primary.

With 7.1 on 2008 the primary and backup server will authenticate both wired and wireless ports for all platforms - Windows PC's, and android and apple wireless.

With 7.1 on server 2012 the backup server will authenticate all these except for the Apple IoS devices, at least those running 9.3x - have not tried to isolate version. The primary works fine for everything.

I went ahead and upgraded to 7.2 and still see the same issue, so seems to be an apple IOS to 2012 issue with radius on the backup server. I see radius traffic from the MSM to the server. 

Might be cert related - I'm using self generated domain certs for the root and server. the backup process copies the primary's server cert over, and that works fine on 2008.

Any suggestions on things to look for here?