ANOTHER CERTIFICATE QUESTION - RUCKUS

[10101010]

I also have just purchased and installed a wild certifcate (COMODO) for my Ruckus ZD300. If I try to access the controller admin from a domain machine with the new url, then I have no problems it recognises the certificate as signed. However, when I try to use a byod device to connect to my wifi it now uses the new domain name but says the certificate is still untrusted. When I look at the details of the certificate on a domain machine compared to a BYOD device it would appear there is no intermedaite certification, Trusted Root entries for the cerificate or a certificate Path.

 

I'm guessing this is a DNS issue, but not sure how to resolve.

 

What have I missed?

[LoundsZ]

I spoke to Ruckus about this today and their response was pretty vague along with a really thick accent I just asked him to email me and this is the response I got:

 

Thank you for contacting Ruckus Support.

 

As discussed over call, if the client visits any HTTPS website before authentication on captive portal SSID he will get one certificate error. This is current design intent and currently there is no fix for this issue. All the vendors are facing similar issue due to added security feature on client end.

 

You can find more detail on below KB article.

 

https://support.ruckuswireless.com/answers/000006337

 

 

------------------------------------

 

Did you find a work around as new browsers such as Edge on Windows 10 doesn't allow you to proceed past the certificate error :@

[10101010]

Edge has so many faults anyway - Just use chrome. Sorry I don't of a fix.

 

and yes - i think i spoke to that guy at ruckkus as well...not very helpful

[Boredguy]

If your SSL was not signed by a trusted root authority, it will throw up the warning on the BYoD devices regardless of what browser you are using. Some will show the "are you sure you trust this connection" straight away or you have to click the advanced option on screen to get to that step.

[free780]

Can your byod device reach CRL sites?

[10101010]

my certificate is signed by trusted authority and yes I still get the 'are you sure you trust...' in all browsers only for my byod devices. ruckkus said I would not be able to resolve this problem

[CraigM]

Depending on who the root CA is, the BYOD devices might not have the entire certificate chain on their devices, whereas on the desktop side the PC's have a much larger certificate database. You can upload the root CA and intermediate CA into ZoneDirector under Configure, Certificates, Add a Trusted CA. This way when your cetificate is presented to clients, the entire chain is present on the ZoneDirector. Should help with the BOYD clients I think. Hope this helps!

[10101010]

thanks Craig. Yep alrady done all that, but made no difference.

[10101010]

ok it's been a while but I need to try and get this resolved.

 

So to answer your question - no sites can be reached until they've authenticated on the captive portal, but we now have some devices that can't access the portal as the certificate is untrusted and it won't load the page at all.

 

(note my byod is vlann'ed off from the core network)

 

ANy more tips out there? or things I can check?

[Boredguy]

We have the same issue with the self signed certificates, but all the devices/browsers we have, give the option to click advanced and then to carry on to the captive page.

 

I am planning on getting a proper SSL from janet later in the month, once I know which provider they are using these days which should resolve the self signed warning again.

[10101010]

things is i purchased a wild card cert from comodo, so its not self signed either. There must be a problem with my setup somewhere. Yes some can click the advance and proceed, but others can't chromebooks and android seem to be a problem at the moment.

[Boredguy]

Yes but if comodo is not already in the device as a trusted RA it fails on that step. Latest version of Chrome fails due to how it handles certificates now.

[10101010]

Craig you were correct, although I had added the wild card and the intermediate, I had not added the root. Restored to default and started again this time adding all three, all sorted.