FortiNAC Captive Portal – HSTS/HTTPS Certificate Errors & CNA Not Triggering

Question

We’re running FortiNAC 7.6.x (NAC-OS) with a trusted 3RD PARTY SSL certificate assigned to our captive portal. BYOD devices are redirected to the registration portal via VLAN isolation and FortiNAC policies.

However, we are encountering the following issues:

HSTS-enabled HTTPS sites (e.g., chatgpt.com, google.com) throw unskippable certificate errors (ERR_CERT_COMMON_NAME_INVALID) when intercepted before registration.

Windows 11 endpoints are not reliably triggering the Captive Network Assistant (CNA).

What we’ve confirmed:
A valid certificate is in place and bound to the portal (port2).

msftconnecttest.com is not in the Allowed Domains list.

DNS and HTTP access to FortiNAC from the Registration VLAN are working.

What we need:
Clear guidance or official best practices to ensure:

Windows CNA detection reliably triggers upon network join

HTTPS/HSTS certificate errors are avoided entirely

Any specific FortiNAC settings required to optimize detection behavior

Looking for any insight into possible misconfiguration, missing detection rules, or additional steps needed to make CNA-based onboarding seamless and secure.

ebilcari · Answer

The choice to accept the redirection mostly resides on the host/browser behavior and any hardening technique that may have been applied in the host. Usually the browser should detect the presence of a captive portal and inform the user before proceeding with normal browsing. Default settings in FNAC Portal > Request Processing Rules should work with most of the end host types.

Firefox example in Win11:

If the user types just the domain, the redirection should happen only using HTTP. If the link comes from a saved bookmark or browser history (https), the browser still should be able to detect that there is a portal and notify the user.

Chrome example in Win11:

new tab.PNG

After pressing the 'Connect' button a new tab with FNAC portal is open.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded