Your connection 1.1.1.1 is not private

[kdgattis]

I have a cisco controller 2504.  We have guest internet plug into port 2 of the controller.  I have layer 3 web authentication set up in which guest see a web site and type a user name and password to get on the guest wireless internet.  However, when I connect I get this every time, "Your connection is not private 1.1.1.1, NET:ERR_CERT_AUTHORITY INVLAID, This server could not prove that it is 1.1.1.1; its security certificate is not trusted by your computer operating system.  I'm unsure on setting up certificates, but I do see one on the controller as 1.1.1.1.  If I export it to my computer and install as a trusted certificate then it works, but how do I get the guest pc's to trust this controller.  Do I need a public certificate?

[Stephen Rodriguez · Accepted solution]

if you want the guest to not get that cert warning, then you would want to get a certificate from a well known provider.

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/70584-csr-wlc-00.html

When you do this, you also need to make sure that the DNS server you give to the guests can resolve the Virtual interface IP/name to the name that you put in the certificate.

HTH,

Steve

[kdgattis]

Looking at the document, I see something called OpenSSL.  Do I get a certificate from that website or could you recommend a well known provider.  Not much experience with certificates.  Just started about 6 months ago on the guest wireless.  We have had wireless for the employees for years but guest is new. 

[Stephen Rodriguez]

openSSl is just a program to let you build the request and combine the files you get back from the provider.

for well known, Thawte, Verisign, GoDaddy...

HTH,

Steve

[George Stefanick · Accepted solution]

Its a bit involved ..

Create CSR

Get CSR signed 

Bind the CSR to private pem

Upload to the controller

Make sure the cert name resolve to 1.1.1.1 (virtual ip address on WLC). 

Add A record like guest.yourdomain.com to resolve to 1.1.1.1

I do this for customers all the time.. ping dcmc.guestnetwork.org 

[kdgattis]

Can I generate CSR on my windows 2008 CA server, or does it have to be public from a third party?

[George Stefanick]

No since your guest won't have your root. You need to have a pubic .. 

[kdgattis]

Ok, another newbie question.  Do I have already a certificate from our website "www.autumncorp.com" from BizCom.  Since BizCom houses our website wouldn't that be trusted.  I'm I looking at this wrong.

[George Stefanick]

Who signs your public certs ? Bizcom sound like a web hosting company.. They don't sign certs. 

 You would create a CSR in openssl and fill out the cert info. The common name you could use guest.autumncorp.com. 

[kdgattis]

Nobody signs public certs.  I have a CA on our active directory server.  I guess so far we haven't needed one until now.  Bizcom is a web hosting and email company.

[George Stefanick]

Yea, so whoever manages you domain or maybe even the web host can get you a signed cert. Like for me I own guestnetwork,org. I go through godaddy .. I provide them my CSR and they burn me the cert tied to my domain. 

This is why I created guestnetwork.org I handle this entire process for customers; csr,cert,A record etc ... It can be a pain for some folks. 

Make sense?

[kdgattis]

autumncorp.com is our domain name and BizCom manages it.  Do I need to get up with them to get a certificate for our domain and install that certificate on my controller.  Another question, if I redirect them to another web site like www.google.com would that bypass the certificate error.  Also, how many certificates do I need?  Just one, or one for each guest logging in.  Not seeing this message on phones or ipads just computers.

[George Stefanick]

You create the CSR in open SSL. You give your CA the CSR and they will burn you the cert. 

Then you take the root, chain, device certs then bind it to the pem in open ssl.

Once that is done then you upload to the controller.

Make sure you use a version of openssl lower than 1.0v.

If you want a guest page then you need the cert. Redirects happen AFTER the page pop up.

You only need one and you can put on your different controllers.

Are you anchoring ?

Delete the SSID from your iPad and try it again. Looks like you may have accepted the cert the first time.

[kdgattis]

Thanks, alot for all your help.  If I only need one certificate for all my controllers how much does a certificate usually cost?  

[George Stefanick]

No worries.. Certs you buy in time .. Like one year is $75 or cheaper .. depends which CA you use to sign.

Feel free to support the rating system if any of this is helpful!