topic Re: About Captive Certificate in General Topics

About Captive Certificate

PanIst — Mon, 10 Nov 2014 15:23:33 GMT

Hi all,

To make visitors not having ssl warning for Captive portal page;

is there a way to do that without purchase a certificate ?(no way for importing cert to the clients)

Re: About Captive Certificate

HULK — Mon, 10 Nov 2014 15:32:39 GMT

As per my knowledge, the answer will be "no". Self generated certificate will not match with client's ( browser) certificate ring. Hence, it will throw a cert warning.

Thanks

Re: About Captive Certificate

ssharma — Mon, 10 Nov 2014 15:55:08 GMT

Hi Panlst,

Since the certificate will be from the firewall, visitor's page will not have any information for the browser. When the client gets certificate it would be Unknown has signed Captive portal and that would generate browser error.

With certificate from trusted 3rd party, it might say Verisign has signed Captive portal, since visitors browser already trusts Verisign cert, there will not be any errors. Hope this helps. Thank you.

Re: About Captive Certificate

hshah — Mon, 10 Nov 2014 16:00:18 GMT

Hi Panist,

That is correct, Guest user will get certificate warning as certificate is locally generated on firewall. Guest browser doesnt know certificate hence it will generate an error.

Regards,

Hardik Shah

Re: About Captive Certificate

dreputi — Mon, 10 Nov 2014 16:09:33 GMT

Hello Panlst,

The answer to your question is 'No' under your conditions. In general, following are the options:

1. Use a certificate signed by 3rd party vendor like Verisign, GoDaddy, etc. This is best solution as this cert will be trusted by all the browsers irrespective of the device.

2. Use a PAN self signed certificate or domain generated sub-ordinate certificate. Install its certificate authority on the client browsers. Though technically this will work, practically it is very difficult to implement this since typically you wouldn't be knowing which device the user will be using. So not scalable.

Hope it helps.

Regards,

Dileep