Captive portal and HTTPS problems

[david_henderson]

We are setting up the Cloudpath captive portal and ran into one issue. When a user with a personal device wants to get on our network, the steps are straight forward:

• User joins our wide open guest network
• They launch a web browser and hit the Cloudpath captive portal
• They are led through the process of securely on-boarding their device

Two issues, the second one more serious

1. If the first page a person hits on their web browser is HTTPS, the get a cert error. If they click continue, they are at the captive portal
2. If the first page a person hits on their web browser is HTTPS and HSTS, they just get an error message, they never get the Cloudpath screen

I never heard of HSTS until today
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Every Google site uses HSTS and of course many people have their home page for their web browser set at https://www.google.com. Has anyone else encountered this? I do have a case open with Ruckus support. From what I read HSTS will become much more common over time

[abhi_maras]

Unfortunately HSTS is a standard that many of the browsers and websites are leveraging and rightly so to avoid redirecting users unknowingly which could result in loss of data for end users. But this poses a problem for captive portal redirection which are legitimate. There is not widely adopted standard right now but like identified above RFC 7710 gives is a way once it is ratified and adopted. This ofcourse affects all vendors and is not applicable only to Ruckus. There are browsers like Firefox who have implemented a 'Click here to login' or 'This network needs login' button that automatically pops up in such cases. We also do recommend using CNA as that uses a http site that does not break the redirect (Apple uses http://www.captive.apple.com)

Hi Shaun,
Can you confirm if you are using Cloudpath or if it is a ZD only question. Also are you getting the 'Certificate not signed error' or HSTS error? If it is prior, who are you using for the certificate signature? Looks like the browser does not identify the signing authority.

--
Regards
Abhi Maras

[ricardo_navarro]

Even after two years of this post, the problem still persists. One of my clients has a Ruckus Cloud installation and several R610 APs. This authentication issue only occurs on Android devices with captive portal for Google login. No issues occur on iOS or desktops. You know state the action recommended by the Ruckus for this case?

[shaun_van_tonde]

Hi.

I am using a Zone Director 1200 Series. I have acquired a certificate signed by Geotrust and also imported the intermediate certificate along with the signed certificate into the Zone Director. The login page used to give me a untrusted error for all clients and this has been solved so I am sure my import procedure was correct. I noticed the non trusted issue mainly on phones using chrome browsers to Authenticate. I was able to replicate the error on a windows 7 machine by typing www,google.com insto the browser after ignoring the captive portal login page.. Just for testing.

I have now upgraded the Zone Director to firmware:

zd1200-9-12-3-0-61

After this I strangely don't seem to get the Chrome certificate error on the laptop anymore no matter how I try. I have yet to test this on various mobile devices. Hoping for the best but we shall see. Not sure if firmware could solve this issue, it doesn't seem likely but I will see what happens.

Regards,

Shaun