Guest portal clera pass wlc

[athan1234]

Dear all:

I'm attempting to solve this issue, but I'm having trouble.

The customer has this error, which is the problem.

Page in blank  and the error ssl_IDMISMATCH

[Flavio Miranda]

Hi @athan1234 

 It seems the certificate was generated for the wrong URL. 

[Flavio Miranda]

@athan1234 

  To fix this, you/we need to understand better how everyting is setup on this devices. Which WLC are you using, are you using ISE as Radius? Which WLC version, ISE version if that is the case.

There is a process in order to use certificate on guests networks. You need to generate the CSR file, you need to send the CSR file to be signed and you need to install the certificate signed to the WLC. During the process the URL need to be informed and it seems the URL was not informed properly.

I am sharing here two links in order to troubleshooting site name mismatch and you can take a look. Maybe you fall in one of those examples.

https://www.thesslstore.com/knowledgebase/ssl-support/troubleshooting-name-mismatch-web-browser/

https://www.digicert.com/kb/ssl-support/certificate-name-mismatch-error.htm

[athan1234]

Hello @Flavio Miranda 

This time, I'm coming, and I'm going to generate a CSR  .I am confising if i will have to put on the CN : www.

[Rich R]

You might find a site that can generate the CSR for you but they generally won't do that because that means they will have the private key for your certificate which is a MAJOR security issue - only you should ever know the private key - it should be treated as strictly confidential.

You can easily install OpenSSL on a PC to generate the CSR yourself:
 https://slproweb.com/products/Win32OpenSSL.html
Use version 1.1.1 because the Cisco WLCs will not be able to handle certificate chains generated by version 3.x

[athan1234]

Rich RI can generate a CSR using the gui, according to the WLC controller. My uncertainty is whether to include the www or not in the CN: field.

[Rich R]

It must exactly match the FQDN so that looks correct.

[athan1234]

I'm confused about the flow guest portal and function of the certificates.

In this case I believe is more difficulty, my customer doesn’t want to have wilcard certificate before that the user has a wilcard certificate and everything works well .

Tell me whether my hypothesis of guest portal flow is correct. If I'm wrong, please correct me.

• The first step is when a user attempts to join to SSID_guest is for the AP to relay information to the wireless access point (WLC), which is equipped with a public certificate for guest users. What does the certificate's purpose , for the guest it is transparent , isn’t it.  it is only for to check it a secure connection between controller and user (this point it is difficult to understand ) 

This certificate on the side WLC. CN:xxxx.es

I'm not sure if I possess what is required for the right works.

Currently, xxxx.es doesn't resolve anything,

Do you believe that his DNS server should have an entry for xxxxxxx.es  in order to be able to resolve the virtual IP of the controller 192.0.2.1?

And the reverse DNS would be to use xxxxx.es to resolve the virtual IP 192.0.2.1.

Some set up side WLC

[athan1234]

Anyone could help me ? 

[Rich R]

What is in your pre-auth ACL Guest_WIFI ? (clue: all IPs and URLs required to complete login should be allowed)

[athan1234]

Hi @Rich R  thanks for your reply

[Rich R]

1. Only that 1 single IP address required for your users to login?

2. Your ACL has a mistake - it's allowing traffic to and from that IP but both with Dest Port HTTPS!  Similar to your DNS entries the return traffic will have Source Port HTTPS not Dest Port right?

[athan1234]

Hello

The traffic is indeed sent to the clear pass by the wlc. the IP address that is being forwarded to the clear pass node

I guess ai modificated the acces list some time , i was reading an artuicule and i leave the same way
hence, the access list is the problem for you.

I am reading this articule , this ACL will be more polite