Technical Tip: Certificate errors when FortiNAC is redirecting secure URLs in the Captive Portal
Description
This article describes that using a Valid SSL Certificate for captive portal security will not completely eliminate certificate errors.
If the host requests secure access using a URL such as https://www.google.com, the request will be redirected to the captive portal for FortiNAC as https. This maintains the https security level, but ultimately the certificate name will not match (the request will be for google.com and the response will be from FortiNAC's isolation IP address) so there is a trust mismatch and the host will translate this to a possible hijacking attempt.
Alternately, if the host requests secure access using a URL, such as https://www.google.com, and if FortiNAC did not maintain the security level of https and returned http instead, this would lead to an encryption error because the request was https and the response was http. In later versions of FortiNAC, the portal page will be available only in SSL mode.
This general situation is well-known among vendors who provide captive portals, as these links indicate:
If the host requests secure access using a URL such as https://www.google.com, the request will be redirected to the captive portal for FortiNAC as https. This maintains the https security level, but ultimately the certificate name will not match (the request will be for google.com and the response will be from FortiNAC's isolation IP address) so there is a trust mismatch and the host will translate this to a possible hijacking attempt.
Alternately, if the host requests secure access using a URL, such as https://www.google.com, and if FortiNAC did not maintain the security level of https and returned http instead, this would lead to an encryption error because the request was https and the response was http. In later versions of FortiNAC, the portal page will be available only in SSL mode.
This general situation is well-known among vendors who provide captive portals, as these links indicate:
Scope
FortiNAC.
Solution
The only way to avoid such errors is to ensure the browser attempts access to FortiNAC initially. Captive portal solutions address this issue: once the host is isolated, a browser window is automatically opened with the captive portal page presented.
For details, refer to the Captive Network Assistant Reference Manual in the Fortinet Document Library (Overview).
Related article:
Technical Note: Captive Portal does not automatically display when in isolation
