topic Certificate issue for a tunneled SSID in SmartZone and Virtual SmartZone

Certificate issue for a tunneled SSID

ali_db0udsohr2q — Wed, 09 Dec 2020 19:00:58 GMT

I have a vSZ-H and a physical data plane appliance with a tunneled SSID configured. SSID works fine however, trying to do WebAuth so it gives a certificate error. Installed the 3rd party valid SSL cert (wild card) and still getting an error in the browser. Viewing the certificate it shows, it is still using the Ruckus cert and not the wild card cert that was installed.

Mapped all the services to this cert and here is how it looks like under the SZ as a Server Certificate. What else is missing?

Re: Certificate issue for a tunneled SSID

pasquale_monar2 — Wed, 09 Dec 2020 21:24:41 GMT

You have gone to System - Certificates - Certificates to Service Mapping and chosen your certificate ?

Re: Certificate issue for a tunneled SSID

syamantakomer — Thu, 10 Dec 2020 15:54:54 GMT

Here is the screenshot for more help.

Please make sure you hit "Ok" to apply the changes.

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Thu, 10 Dec 2020 15:55:43 GMT

Yes services are mapped. Management, AP Portal and HotSpot.

Re: Certificate issue for a tunneled SSID

syamantakomer — Thu, 10 Dec 2020 16:27:55 GMT

If you don't see the cert at all, it could be certificate mapping issue or certificate is not imported correctly.

Try to delete and reimport the cert.

Recommended procedure:

- Export the cert in .cer format with base-64 encoding.
- Export complete chain in the same format (server cert, intermediate and root cert).
- Import the certs in correct sequence and then upload the private key (if key is protected, please use the passphrase).
- Once done, map the certificate with services and apply the settings.

Note: Changing cert to service mapping will restart some services so GUI may not be available for some time (usually 10-15 minutes).

Re: Certificate issue for a tunneled SSID

syamantakomer — Thu, 10 Dec 2020 16:31:05 GMT

Also confirm if you are using web auth with AD and TLS is enabled in server settings.

Authentication with AD+TLS will only work if cert has COMMON NAME set as IP address. This is a known limitation as of latest version.

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Thu, 10 Dec 2020 16:37:27 GMT

Yes that is how mine is setup.

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Thu, 10 Dec 2020 16:47:02 GMT

So you mean when I generate the csr under common name I use the IP of the vSZ-H?

Re: Certificate issue for a tunneled SSID

syamantakomer — Thu, 10 Dec 2020 16:48:12 GMT

Try to reimport the cert as I have suggested in my previous comment.

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Thu, 10 Dec 2020 17:34:21 GMT

Can you confirm what did you mean by the IP in the common name? Did you mean when generating the csr I use the IP of the vSZ?

Also since there is a physical data plane appliance involved and there are two vSZ nodes do I have to use the same cert for Intra Device Communication?

Re: Certificate issue for a tunneled SSID

syamantakomer — Thu, 10 Dec 2020 18:31:46 GMT

Hi Ali,

Please first confirm what exact issue you are facing and what is the WLAN and AD server profile configuration.

Because you may not be hitting that issue.

Below are the example of CN with name and CN with IP on a cert.

Subject: C = US, ST = xyz, L = abc, O = Ruckus Wireless, CN = *.ruckuswirelss.com

Subject: C = US, ST = xyz, L = abc, O = Ruckus Wireless, CN = 10.10.10.1

Regards,

Syamantak Omer

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Thu, 10 Dec 2020 18:46:30 GMT

WLAN SSID is setup to use WebAuth with AD Auth. I think I'm going to just create a ticket because apparently there is no good Ruckus documentation as usual on how to accomplish all this.

Re: Certificate issue for a tunneled SSID

syamantakomer — Fri, 11 Dec 2020 12:42:40 GMT

Ok, but did you configure AD profile with TLS enable?

And do you see a certificate warning when users connect to login portal?

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Fri, 11 Dec 2020 14:14:27 GMT

Are you talking about under the SSID and Authentication Service instead of RADIUS using AD Authentication and turning on TLS?

When the user connects to the portal they don't even get the new cert, they still get the Ruckus cert.

Re: Certificate issue for a tunneled SSID

syamantakomer — Fri, 11 Dec 2020 14:35:41 GMT

Hi Ali,

If users are getting cert error (portal shows Ruckus Default cert) when they connect to the portal, this means cert is not properly imported.

Try the procedure I have provided, reimport the cert. If still facing the issue, please report it to support.

Also do not get confuse with authentication server settings, because first, web portal should present the correct certificate which is not happening in your case.

Re: Certificate issue for a tunneled SSID

ali_db0udsohr2q — Fri, 11 Dec 2020 14:59:08 GMT

So I understand what you are saying now. If the cert is imported wrong shouldn't it also not work when accessing the GUI of the vSZ? When doing so, correct cert shows up.