Hi and thank you for your response.
I feel that I need to clarify a few things. Here is my parameter-map config (a bit edited):
parameter-map type webauth global
virtual-ip ipv4 1.1.1.1 virtual-host webauth.example.com
intercept-https-enable
!
!
parameter-map type webauth webauth_external
type webauth
redirect for-login https://webauth-external.example.com/v2/login.html
redirect portal ipv4 x.x.x.x
So the problem here is that a web browser of the client gets the following redirect URL:
https://webauth-external.example.com/v2/login.html?switch_url=https://1.1.1.1/login.html&redirect=http://www.cnn.com
Then after a successful login on the external portal, the user gets redirected back to https://1.1.1.1/login.html. Here is the core of my problem. I think that the parameter "switch_url" should be with the name webauth.example.com since I configured it as the "virtual-host". This is the behavior we see with our old Cisco WiSM1.
When the redirect goes to https://1.1.1.1/login.html the client complains about the certificate, because it is not issued to that IP address but to the hostname.
I can verify that the client does not complain about this if I manually edit the redirect URL on the client to the following:
https://webauth-external.example.com/v2/login.html?switch_url=https://webauth.example.com/login.html&redirect=http://www.cnn.com
Then the redirect after authentication goes to https://webauth.example.com/login.html and the client accepts the certificate and everything is peachy.
Do you see my problem? And yes, the virtual IP resolves to the name in DNS.
