Certificate Warning Overview

When a CA-signed certificate is imported to SZ certificate store and applied to Hotspot (WISPr), SZ captive portal and internal portal page use the imported certificate. However, if an end user enters a HTTPS URL through the browser manually, one certificate warning message is still expected to be seen in the UE browser.

SZ captive portal need to complete the SSL handshake before sending 302 redirect response to UE. Since the FQDN(common name) in the certificate is impossible to match the URL that UE tries to visit, the browser will display a certificate warning.

To avoid certificate warning messages, major operating systems already have built in mechanisms to detect captive network and sending HTTP requests (not HTTPS), so that users can be redirected to a portal page automatically without any certificate error.

• Apple iOS CNA (captive network assistant) sends HTTP requests to some static URLs to detect captive portal.
• Android devices detected it by sending HTTP requests to http://clients3.google.com/generate_204.
• Window 7 sends HTTP requests to http://www.msftncsi.com/ncsi.txt to detect captive portal.

In either case, user devices pop up a window and redirect users to the portal page with HTTP requests instead of HTTPs requests. No certificate warning will be shown if the UE is redirected automatically by the operating system.