Apple Devices with Captive Portal

[Jasys]

Having had quite a few issues, there is one annoying one that is remaining, I have a Fortigate running an SSID using the FAC as the Portal for registration etc, which is working fine on Android, Laptops etc. but any apple device when selecting the SSID redirects to the "captive.apple.com" page on the phones and displays the message "Hotspot login, cannot open the page, the server cannot be found"

if the user browses to this captive address you do get the "success" message. Im raising this here as there are a few articles that tell you , on the Fortigate to "exempt" captive.apple.com from the SSID, which I have done. this article: Captive Portal on Apple devices - Fortinet Community doesnt do anything, is anyone able to offer some assistance? is this because the iphone has cellular data turned on or related setting?

thanks

[Markus_M]

You'll need a tool to check certificates sent by the server (FAC). As said, just browsing FortiAuthenticator from the end station without a captive portal has to work without issues.

You can use OpenSSL to check from within the guest network, unauthenticated, as to what FortiAuthenticator sends. You can either install it directly on Windows or use it from within WSL on Windows or from Linux natively. Command to use:
openssl s_client -connect fortiauthenticator.fqdn.local:443
expected output for sample:

openssl s_client -connect community.fortinet.com:443 -tls1_2
CONNECTED(00000003)
depth=2 C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
verify return:1
depth=1 C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
verify return:1
depth=0 C = US, ST = Texas, L = Austin, O = "Khoros, LLC", CN = secure03.lithium.com
verify return:1
---
Certificate chain
0 s:C = US, ST = Texas, L = Austin, O = "Khoros, LLC", CN = secure03.lithium.com
i:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Jun 27 00:00:00 2025 GMT; NotAfter: Jul 28 23:59:59 2026 GMT
1 s:C = US, O = DigiCert Inc, CN = DigiCert Global G2 TLS RSA SHA256 2020 CA1
i:C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Mar 30 00:00:00 2021 GMT; NotAfter: Mar 29 23:59:59 2031 GMT

whereas 0 = your FortiAuthenticator certificate, 1 = the intermediate that signed FortiAuthenticator certificate (0). Maybe there are more. FAC is however expected to send every certificate in the chain, except the root CA, which should already be on the client.
Please share the output, that might help.

Also make sure that these are in place (iPhones seem to require this and I didn't see it confirmed yet):

config user setting

set auth-secure-http enable

end

[Jasys]

Yes, I have "set auth-secure-http enable" here is the output from openssl:

Can see an error "Verify return code: 20 (unable to get local issuer certificate)"

C:\Users\XXXXXXj>openssl s_client -connect myfacfqdn:443
Connecting to 10.31.1.212
CONNECTED(0000015C)
depth=2 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Ce
rtificate Authority - G2
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.god
addy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
verify return:1
depth=0 CN=myfacfqdn
verify return:1
---
Certificate chain
0 s:CN=myfacfqdn
i:C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godadd
y.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
v:NotBefore: Feb 19 18:35:11 2025 GMT; NotAfter: Mar 23 18:35:11 2026 GMT
1 s:C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godadd
y.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
i:C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certi
ficate Authority - G2
a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
v:NotBefore: May 3 07:00:00 2011 GMT; NotAfter: May 3 07:00:00 2031 GMT
2 s:C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., CN=Go Daddy Root Certi
ficate Authority - G2
i:C=US, O=The Go Daddy Group, Inc., OU=Go Daddy Class 2 Certification Authori
ty
a:PKEY: RSA, 2048 (bit); sigalg: sha256WithRSAEncryption
v:NotBefore: Jan 1 07:00:00 2014 GMT; NotAfter: May 30 07:00:00 2031 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
REMOVED CERT
-----END CERTIFICATE-----
subject=CN=myfacfqdn
issuer=C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.goda
ddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: rsa_pss_rsae_sha256
Peer Temp Key: X25519, 253 bits
---
SSL handshake has read 4725 bytes and written 1630 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_128_GCM_SHA256
Protocol: TLSv1.3
Server public key is 2048 bit
This TLS version forbids renegotiation.
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_128_GCM_SHA256
Session-ID: BDD570DD7FCBDF286CFC66C801995A409C9D64C2814EBB3DFA7C9AA134D62533

Session-ID-ctx:
Resumption PSK: 5A307FFBB8E01A6F9B3672B31BCD08B4D53755CB8DBD683FB9A622220739
8D86
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0010 - ce 42 3c 1e 71 07 d3 34-10 4a 98 e9 82 fb c3 91 .B<.q..4.J......
0020 - 05 3f 07 ce c9 7b df 2b-0a 1c ce 69 fb 54 5f 96 .?...{.+...i.T_.
0030 - 7a 57 7b e0 df 72 99 35-ab 60 9b 0f 94 45 41 e9 zW{..r.5.`...EA.
0040 - 3a f0 b5 11 e2 4a f1 61-d1 53 9c 2f 15 29 89 b2 :....J.a.S./.)..
0050 - 21 4b c2 1e f1 f6 be 14-a4 2b d0 ec a4 38 d2 52 !K.......+...8.R
0060 - e0 11 30 ec c3 95 37 0d-d5 93 3c 7a 28 99 8d d3 ..0...7...<z(...
0070 - fe 19 a1 4e 85 67 cb cb-32 8d 67 8d b8 9c 0d 69 ...N.g..2.g....i

Start Time: 1760443305
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK

[martijndhondt]

We have nothing on that setting.