Certificate chaining with Captive Portal

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Certificate chaining with Captive Portal

L3 Networker

Hello,

We have a PA-3020 running PanOS 5.0.0 in L3 deployment. We have just one Private zone and one Public zone for the instance.

I have configured a Captive Portal policy on the Private zone gto ensure that all users that are not authenticated by User-ID (users who are not logged in the domain) have to authenticate beffore accessing resources. I have set a Captive Portal redirect policy web-form based, linked with LDAP settings.

It works fine, users are redirected to the web-form and they can login if they have a login/password.

Then we have tried to import a certificate on the PaloAlto device in order to avoid the warning message in the browser. We have tried to add the CA root certificate as well as the intermediate certificate. From the PaloALto menu, the chaining seems correct (see certificate_chain.jpg) but the warning is still there in the browser. When we look at the certificate sent by the PaloAlto to the browser, we can see that the chaining is not effective.

However, it works fine for the management access : the certificate chain is effective and the certificate is well trusted by the browser. Also it seems that it is only related to the Captive Portal feature.

You can also see the Captive Portal settings (captive_portal.jpg).

Kind Regards,

1 ACCEPTED SOLUTION

Accepted Solutions

You may need to re-import the Captive Portal certificate (*.aiglon.ch) with the intermediate CA included in the chain. The firewall has the intermediate and it can "see" the full chain, but unless it is configured to send the intermediate with the CP certificate, it will assume the client has that intermediate and not send it.

The following document was written with two intermediate CAs in mind, but the principle is the same. You would create e hybrid certificate with *.aiglon.ch on top and "GlobalSign Organization Validation CA" below that. You don't need the root ("GlobalSign Root CA") because a client wouldn't trust a root that was sent to it anyway. Here's the doc:

How to Install a Chained Certificate Signed by a Public CA

Hope that helps!

Greg Wesson

View solution in original post

9 REPLIES 9

L2 Linker

Hi,

Could you add a screenshot of the displayed URL when you are reaching your captive Portal Authentication Webpage?

Thanks

Regards

-Nicolas

Hi Nicolas,

Thanks for your answer.

Here are three screenshots : One shows the url when accessing the Captive Portal, the others show the certificate details.

Regarsdurl.pngcertificate_1.pngcertificate_2.png

You may need to re-import the Captive Portal certificate (*.aiglon.ch) with the intermediate CA included in the chain. The firewall has the intermediate and it can "see" the full chain, but unless it is configured to send the intermediate with the CP certificate, it will assume the client has that intermediate and not send it.

The following document was written with two intermediate CAs in mind, but the principle is the same. You would create e hybrid certificate with *.aiglon.ch on top and "GlobalSign Organization Validation CA" below that. You don't need the root ("GlobalSign Root CA") because a client wouldn't trust a root that was sent to it anyway. Here's the doc:

How to Install a Chained Certificate Signed by a Public CA

Hope that helps!

Greg Wesson

IMHO we are looking at a browser/ client issue here.

Looks like you are using IE, the issuing CA 'Globalsign Organization Validation CA' needs to be trusted on your client.

Try to import the intermediate CA into the 'Trusted Root Certification Authorities' store on you windows client.

If the error disappears you can distribute the intermediate CA via GPO in your AD.

Thanks

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!