ASA Captive Portal Certificate

[JRDIAZ758]

My users are not very PC savy so when Firepower redirects them to the captive portal, sometimes they do not click continue to proceed to the portal (since its a untrusted https site), so i want to apply a internal trusted cert to it so it takes them directly to it. 

so how can i apply a certificate to my captive portal ??

[Marvin Rhoads]

When you setup captive portal it gives you the option to select the certificate from among those installed on your server.

http://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/realms_and_identity_policies.html#task_B09D4711593E4506890BB8BE25B39B31

So first get and upload a certificate onto FMC and it will then be available for use. If you have a wildcard certificate issued from a trusted CA for organizational internal use, that usually works fine.

[JRDIAZ758]

hey, for the cert to work it needs to point to a name. now how do i make firepower redirect the user to a URL instead of an IP?

becuase this is what i get for the captive portal

https://10.215.5.37:885/x.auth?s=%2FrZ81pWdODMVFRWqLU36fY4Jww395sMbfzcSSki6KRw%3D&u=http%3A%2F%2Fgo.microsoft.com%2Ffwlink%2F%3FLinkID%3D219472%26clcid%3D0x409

[Marvin Rhoads]

I'm not sure if you can do that currently. I would suggest openeing a TAC case to check.

If it was your own internally generated certificate, you could make the CN equal to the IP address or alternatively add a Subject Alternative Name (SAN) of the IP address.

[mwebb]

When using HTTP Response page Firepower will not redirect to hostname.  Thus captive portal as people are used to using it is broken.  Especially so in a BYOD environment (Universities, Hospitals, Hotels, Restaurants, Malls, etc) Clicking through SSL warnings is terrible posture, especially for a security company.   See bug here:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz37162

If possible please open a case under this bug and contact your account rep to get some exposure.  For some reason this is listed as an "enhancement"q

[Dill]

Captive Portal was working by using the FQDN in version v6.2.3 now after the update to v6.2.3.6-37, the bug is back and using the IP address instead causing certificate errors.   Even with an IP as SAN you still get the certificate warning in Firefox.  

[abdy]

I have the same problem.
I cannot avoid this annoying cert warning.

Appreciate if someone can share the solution of this issue.

Thanks!