BYOD - how to download SSL Cert

[mdrabble]

How do people get users to download and install the SSL Cert for BYOD?

 

Users authenticate via Radius (NPS) and then passed on to Fortigate for filtering rules.

Using Unifi Wifi and Fortinet for Firewall etc.

 

I have set up a page on our SharePoint site which written info on what they need to do and why.......

 

I was thinking of having a download button and QR code - but trying to decide on the best location to host the SSL Cert.

 

Can't host on school website as Juniper Hosted site won't allow the upload.

Did think about SharePoint, but they have to log in to access, as no option to allow anyone to access - plus wants to open as a text file!

 

Ideas/suggestions welcome :-)

 

Cheers

[mjhardisty]

You could setup an internal IIS server that allows anonymous access and just serves the cert, link it from the captive portal. Or could the file be copied to the UniFi controller using SSH and served from there?

[synaesthesia]

You could setup an internal IIS server that allows anonymous access and just serves the cert, link it from the captive portal. Or could the file be copied to the UniFi controller using SSH and served from there?

 

Make sure to lock it down so it can only be accessed by internal IPs. That's still daft but as far as I know the only way to do it (and one of many things forcing BYOD to die)

[Davit2005]

Similar to what we did 8 years back. Jus store the SSL cert on a web server and provide a link on the captive portal. Other changes may need to be done. Edited January 20, 2025 by Davit2005

[Noxid_w]

Is this an ssl certificate for filtering or for PEAP?

[Davit2005]

Is this an ssl certificate for filtering or for PEAP?

 

Generally for filtering as requires the traffic to be decrypted by your filtering device i.e MITM. Of course there are other methods too.

Edited January 20, 2025 by Davit2005

[mdrabble]

Yep SSL is just for filtering.

 

I was resisting the need to spin up a VM just to host IIS and single SSL Cert, but looks like that many be the only option :-)

 

Cheer Guys :-)