Public wildcard certificate for use with Captive Portal

[bradcl_15]

Hi guys,

I have a scenario whereby we have a publicly issued wildcard certificate for our organisation and I'm wanting to use this in conjunction with Captive Portal on the PA-500. I've set all policies up and configured Captive Portal to redirect to a Loopback interface on the firewall (through the use of a DNS name which resolves to the IP of the loopback).

This wildcard certificate is mainly to allow BYOD devices to connect via the captive portal without certificate errors.

- Is this possible though because I read that the Captive Portal 'Redirect' field needs to match EXACTLY what is configured as the CN in the certificate.

- The wildcard certificate CN is *.blahblah.com and not the FQDN... 

I can't edit the certificates attributes (e.g. hostname/SAN fields) because its a public certificate.

Thanks in advance.

Brad

[MRosloniec · Accepted solution]

Yes this is possible - I am actually doing the exact same thing.  What you need to do is create a DNS name that matches the FQDN of the cert.  For instance, if my cert is issued for *.domain.com, then my redirect host needs to be captiveportal.domain.com.

[bradcl_15]

Great news. Glad to know someone else is trying to achieve the same as myself. I seem to have it working with business machines but not BYOD devices.

Have you experienced any issues with iPad/Android devices and Captive Portal redirection?

Can't seem to browse to the portal page from those devices.