NAC - isolation vlan firewall rules for captive portal

[nflnetwork29]

Hello we a have installed a public certificate on our captive portal . when a machine is connected its initial  location is the isolation vlan as per design. 

Cert looks to be installed correctly but we are still getting SSL Certificate error upon initial browser launch . 

Do we need to modify the firewall rule for isolation vlan? do we need to allow outbound internet access to the certificate authority ? What are people doing in this scenario. 

Running FortiNAC-f 7.4

Thanks, 

[ebilcari]

If a public certificate is used, the root CA should be already present in the end host so internet access is not required. Usually this happens when the intermittent certificate is not properly uploaded in FNAC, some details can be found in this article.

[nflnetwork29]

well i was on with TAC and we confirmed the certificate was loaded correctly.  anything else i can check? 

[ebilcari]

Can you tell which URL is listed in the browser when you get the certificate error, is it still showing the original website or is it already redirected to the FNAC portal page?