NAC - isolation vlan firewall rules for captive portal

Hello we a have installed a public certificate on our captive portal . when a machine is connected its initial  location is the isolation vlan as per design. 

Cert looks to be installed correctly but we are still getting SSL Certificate error upon initial browser launch . 

Do we need to modify the firewall rule for isolation vlan? do we need to allow outbound internet access to the certificate authority ? What are people doing in this scenario. 

Running FortiNAC-f 7.4

Thanks,