Apple Devices with Captive Portal

[Jasys]

Having had quite a few issues, there is one annoying one that is remaining, I have a Fortigate running an SSID using the FAC as the Portal for registration etc, which is working fine on Android, Laptops etc. but any apple device when selecting the SSID redirects to the "captive.apple.com" page on the phones and displays the message "Hotspot login, cannot open the page, the server cannot be found"

if the user browses to this captive address you do get the "success" message. Im raising this here as there are a few articles that tell you , on the Fortigate to "exempt" captive.apple.com from the SSID, which I have done. this article: Captive Portal on Apple devices - Fortinet Community doesnt do anything, is anyone able to offer some assistance? is this because the iphone has cellular data turned on or related setting?

thanks

[Markus_M]

I don't want to bother too much about that beautiful article and its documented steps and will stop on referencing it, but it is important to understand to what the browser is connecting when receiving that warning.

"No internet connection" is not helpful, it will say that the browser is getting redirected to its built-in captive portal check, which would in case of the Edge browser, a Microsoft page. The packet capture towards the client IP will show its communication and failures, if any.

Remember:

When the client connects, it will do DNS for captive detection pages, get an IP. TCP handshake to the IP, FortiGate blocks this and answers with a redirect to its own page, which would be https://fgt-fqdn:1003. Client will attempt DNS to resolve it, access the result (which must be the FortiGate interface IP) and then connect to it. FortiGate will again respond with an FQDN for redirect, which is then https://fac-fqdn. Again, client will DNS resolve the FortiAuthenticator and again TCP connect to it.

Entering an FQDN manually to the browser will circumvent the automatic attempt, if it otherwise fails. If that FQDN is an HTTPS page, FortiGate will still attempt blocking it, but in order to do so, it needs to resign the connection with its own untrusted CA certificate, resulting in a certificate warning.

All of the above is visible with a packet capture towards the client IP. As FortiGate will do NAT towards WAN, that traffic would be not part of such a filter, but it is also not important.

More for guesswork:

For Apple devices, you would need to have the FortiGate use the secure redirect to the FortiGate. FortiGate is required to have a valid certificate that the end user can verify without warnings. The result is that redirect #1 will go for tcp/1003 instead of tcp/1000:
config user setting
  set auth-secure-http enable
end

[Jasys]

Hi Markus, this all works flawlessly for any other device except apple.

The certs are valid , the auth is set.. the FortiGate has a cert signed by godaddy as does the FAC. The portal is being triggered as they get the untrusted warning with the fac FQDN

[distillednetwork]

When you look at the "invalid" certificate, are you seeing the entire chain on the client? (the cert, intermediate and root?)

[Jasys]

From memory, the cert that isn't trusted, is just the cert. The godaddy signed one for the FortiGate Interface "auth.portal.xxxxxx.uk"  expiry is in 2026

[martijndhondt]

Did you use Tunnel mode for the SSID? I had more success with the tunnel-mode.
Also, policy from guest-range to DNS-server to allow resolving and HTTPs to the FortiAuth.
I also used a wildcard-cert on my FortiGate for authentication and set the following:

config firewall auth-portal
    set portal-addr "guestportal.xxxx.com"
end

config user setting
    set auth-type http https
    set auth-cert "star-xxxx-com"
    set auth-secure-http enable
end

 I also exempted the destination of the firewall auth-portal (see above) and the DNS-servers on my SSID as well as the IP of the FortiAuth.

[Jasys]

Hi, yes, all of this is correct, it all works, tested for myself today, Android, Google Phone, Windows Laptop, all trust and display the portal registration.  This is only happening on Apple phones, and its getting so annoying, I cant find anything on Fortinet or Apple communities, Certs are valid and trusted chain is installed. The FAC has a DNS entry on the gate which resolves correctly. its only apple devices that fail, so I kind of know the FAC and GATE are setup correctly, thank you for your comments though :)

is your set auth-ca-cert set to anything? wonder if that would help?

[Markus_M]

You must define where the error comes from.

- If the certificate error appears from the FortiAuthenticator, when FortiAuthenticator is giving the certificate, that must be looked at. Can the client device browse the FortiAuthenticator directly (with the address that FortiGate would otherwise instruct the client to use for FortiAuthenticator).

- If the error comes from FortiAuthenticator, ANY setting on FortiGate, outside the redirect fqdn is irrelevant. The "auth-ca-cert" can be ignored (and every other setting as well). The captive portal works sequential, so if there is an issue at the FortiAuthenticator, with presenting its certificate, the previous steps will all be correct.

Can you browse the FortiAuthenticator from the client side? It mustn't give an untrusted certificate warning.

Do you have a screenshot of the warning?

[Jasys]

the cert is guest.auth.xxxxxx.local which is the cert on the FortiGate (Wireless interface)

config user setting
    set auth-type http https
    set auth-cert "guest.auth.xxxxx.local"

This is signed by Godaddy, and has no issues on any other device, if the iphone tries to browse directly.

behaviour path below:

“In IOS device - Mobile data disabled, auto-join/auto-detect disabled against GUEST-WIFI, forgot SSID & reconnected

Connected to GUEST-WIFI

'No Internet Connection' showing against SSID

Opened Safari, navigated to BBC.CO.UK

'This connection is not private' displayed in browser

Entered http://captive.apple.com/hotspot-detect.html in browser address bar (Success)

When Link opened in EDGE browser - 'Connect to a WiFi hostpot shown' - clicking on 'connect' reverts to the same page. Still 'No Internet Connection' showing against SSID

When Link opened in SAFARI browser - 'This connection is not private - This website may be impersonating fortiauthenticator.fqdn.local

Clicked on view certificate - shown as valid until 23/03/26, but not trusted.”

same if you go direct to the FAC address.

[Markus_M]

Multiple things that are unrelated to each other.

@Jasys wrote:

same if you go direct to the FAC address.

---

That must work without error. First verify that this indeed is the FortiAuthenticator certificate. If the phone has a problem trust what FortiAuthenticator sends it may have one or multiple reasons.

- Specifically Apple devices will not trust certificates with long validity times, more than 397 days (reference).

- the Apple devices may not have the intermediate certificates installed and fail trusting what the FortiAuthenticator sends.

You may have to import the intermediate certificates to FortiAuthenticator trusted CA section in order for FortiAuthenticator to send them.

The apple browser may give you more details for the warning.

---

@Jasys wrote:

Entered http://captive.apple.com/hotspot-detect.html in browser address bar (Success)

---

What does "Success" mean? If the browser gives you a message, then your captive portal test is incorrect. You're not getting redirected, which is possible if you are already listed as authenticated on FortiGate with your client IP (firewall user monitor or CLI command "diag firewall auth list"). Before every test, see that your user is not listed on FortiGate with the device IP. Remove it if needed (deauthenticate).

[Jasys]

The FAC has the Full Chain, as does the FortiGate, All Valid, Root expires in 2031, Intermediate in 2031 and the cert itself in 2026, There are no authenticated users on the Gate for the iphone testing. Every avenue exhausted!  Apple forums have some information on this, but no details on the fix. its so fustrating that it all finally works except for the iphones, 

the key here is "'This connection is not private - This website may be impersonating fortiauthenticator.fqdn.local" why does it think this on apple?  I think I need to just give up , which isnt good for the customer, but I cant find a resolution, thank you for all your help and insight though, it is appreciated.