I've got users Authenticating using the script below, and then I would LIKE the users to be redirected to a webpage that opens in Safari so that certificates can be installed. At the moment, they just get directed to that webpage (under the settings for the "URL for the user to be directed to after authentication"), but remain in the pop-up CNA window, rather than it opening automatically in Safari. Certificates cannot be installed from the CNA window!
What I've had to do in the meanwhile is to disable the CNA window for hotspots (nice feature of 9.7) and tell users that, after joining the hotspot, they need to open Safari themselves. (Actually, that's pretty normal behaviour anyway, isn't it!)