The problem with the WiFi certification system is that it's not slow to get a certificate, it's bad for the certification page or pop up a tip."It's not safe."The root causes are almost all on the HTTPS certificate. The redirection mechanism for Portal authentication and encryption of HTTPS naturally conflict with the user browser when accessing the HTTPS website, AC or gateways hijack traffic to the authentication page, which the browser will consider as an intermediary attack and directly intercept. The certificate is poorly designed, half users are not connected to the Internet.
Why can't HTTP sites play the authentication page?
The rationale for Portal authentication is that if a user does not have access to any of the sites, or if an AC or gateway has requested HTTP to be redirected to the certification page. HTTP is a specified transfer and redirection is easy to do. But the HTTPS website first creates an encryption channel for TS before transmission, and the browser first verifies the server certificate, which cannot be inserted into redirection at this stage. Users open 100 degrees to HTTP so they can pop pages, and when they open a pavilion, HTTPS doesn't pop up, users think it's a network that's broken and actually a certificate and re-direction mechanism.
Solution one: guide users to the HTTP website first
The simplest way is to start a HTTP site in the WiFi connection note, such as neverssl.com, triggering Portal re-direction. But this is not an economic program, and users do not operate with instructions and experience it badly. Apple and Andre will automatically test whether the network needs authentication, and connect to WiFi by automatically accessing a HTTP detection address and triggering the Portal page popup. But the page that is popping out by CNA is not a complete browser and some authentication methods cannot run in CNA, such as micromail scanning certification requiring the call of micro-mail APP or the CNA.
Solution II: Portal Server Configuration HTTPS Certificate
The formal practice is to configure a credible HTTPS certificate for the Portal server and let the authentication page itself walk HTTPS. Even if users are stopped accessing the HTTPS website, the certificate that the browser sees is credible and not unsafe. The certificate must be issued by the regular CA, it cannot be called with a self-signed certificate browser. The domain name should match the certificate, and Portal's page address cannot be verified with an IP certificate. The enterprise is deployed with a specialized Portal domain name, such as wifi-auth. Enterprise domain name.com, the binding certificate, which is used for the configuration of External Portal URL on AC.
The certificate expired as a hidden bomb.
Once Portal certificates expire, all users will see WiFi connected."Your connection is not private."The certificate is usually valid for one year, and the carrier easily forgets its renewal. It is recommended that the certificate be extended 30 days in advance to test the environmental certification chain, without missing intermediate certificates, before it can be transferred to the production environment. Some CA-issued certificates require intermediate certificates, only with server certificates not containing intermediate certificates, and some browsers report incomplete certificates chains.
Apples and Andre's window-blank behavior is different.
Apple iOS automatically pops up the CNN window after WiFi connects it, and the window loads Portal page and closes it when authentication succeeds. The CA mechanism in Andre has been different for its manufacturers, the original Andre plays, some of which is custom-made and no-doed, requires users to manually open a browser trigger. Portal pages are to match: CNA windows are small, so they don't have too wide layout; if authentication succeeds, the CNA window will be shut down automatically and the switch will result in page blockage."Cancel"Opens the authentication page with a full browser.
Technical limitations of the reoriented HTTPS
Even if Portal pages are accompanied by HTTPS certificates, the AC or gateway cannot directly hijack HTTPS traffic for redirection because TLS handshake is done between browsers and target servers, and intermediate devices cannot be inserted. The practice is that the first HTTP request to intercept a user by AC or gateway is redirected or that an uncertified user ' s DNS decomposition is directed to a Portal server via DNS hijacking. DNS hijacking is ineffective if the user manually matches DNS (e.g. 8.8.8.8). It would be more prudent to use the IP-based strategic route on a gateway, with all 80 and 443 port traffics of uncertified users being diverted to Portal servers, which handle reoriented.
Jump problems after authentication successful
After user authentication is successful, Portal pages are usually jumped to the site that the user intended to visit or to a designated network of officials. The 302 re-direction of HTTPs is no problem, but if you jump to HTTPS, the browser will recreate TLS connections, and in the process users will see a connection failure if AC release policy has not been put into effect (some AC Radius CoA releases have hundreds of millisecond delays). The solution is to stay two to three seconds on Portal pages after certification has been successful, or whether the AJAX queries test network is operational before jumping.
_Other Organiser
Checks before you go online: whether Portal domain names have been solved to the server, whether certificates are issued by a regular CA, whether certificate chains are complete, whether certificates cover a cycle of a dimension, whether Portal URL on AC is available with domain names instead of IP, and whether server firewalls are open at port 443. Checks quarterly after going online: whether certificates will expire, do not solve domains properly, whether HTTPS has access to browser warnings, and whether windows for different mobile phone types are normal.
The issue of the HTTPS certificate for the WiFi certification system at enterprise appears to be minor and is actually the first step in a user's experience. Portal servers have credible certificates, domain names and certificates that match, certificates are outdated and extended early, apple Andre windows are adapted separately, certification has been successfully rolled out with delays.