About Captive Certificate

[PanIst]

Hi all,

To make visitors not having ssl warning for Captive portal page;

is there a way to do that without purchase a certificate ?(no way for importing cert to the clients)

[HULK · Accepted solution]

As per my knowledge, the answer will be "no". Self generated certificate will not match with client's ( browser) certificate ring. Hence, it will throw a cert warning.

Thanks

[ssharma]

Hi Panlst,

Since the certificate will be from the firewall, visitor's page will not have any information for the browser. When the client gets certificate it would be Unknown has signed Captive portal and that would generate browser error.

With certificate from trusted 3rd party, it might say Verisign has signed Captive portal, since visitors browser already trusts Verisign cert, there will not be any errors. Hope this helps. Thank you.

[hshah]

Hi Panist,

That is correct, Guest user will get certificate warning as certificate is locally generated on firewall. Guest browser doesnt know certificate hence it will generate an error.

Regards,

Hardik Shah

[dreputi]

Hello Panlst,

The answer to your question is 'No' under your conditions. In general, following are the options:

1. Use a certificate signed by 3rd party vendor like Verisign, GoDaddy, etc. This is best solution as this cert will be trusted by all the browsers irrespective of the device.

2. Use a PAN self signed certificate or domain generated sub-ordinate certificate. Install its certificate authority on the client browsers. Though technically this will work, practically it is very difficult to implement this since typically you wouldn't be knowing which device the user will be using. So not scalable.

Hope it helps.

Regards,

Dileep