When deploying an external guest captive portal on a FortiGate firewall, users often encounter frustrating "Your Connection is Not Private" or NET::ERR_CERT_COMMON_NAME_INVALID warnings during redirection. This happens when FortiGate serves its default self-signed factory certificate instead of a publicly trusted domain certificate during the HTTPS handshake.
This guide provides a step-by-step walkthrough on how to generate a compatible PKCS#12 (.pfx) certificate, upload it to FortiOS, and configure FortiGate CLI redirection parameters to guarantee seamless, error-free guest authentication.
Prerequisites & DNS Setup
Wildcard / SAN Certificate: You must own a valid SSL certificate (wildcard or specific subdomain) issued by a publicly trusted Certificate Authority (e.g., Let's Encrypt, Sectigo, DigiCert).
DNS Record: Create an A record in your external (or local split-brain) DNS mapping your chosen portal FQDN (e.g.,
guest.yourdomain.com) to the IP address of the FortiGate interface handling the captive portal traffic (e.g.,192.168.1.1).
Step 1: Prepare the PKCS#12 (.pfx) Certificate File
FortiOS often requires the private key, primary certificate, and intermediate/root CA bundle merged into a single package to construct the full trust chain properly.
If you have separate OpenSSL key and certificate files, generate a .pfx archive using OpenSSL:
Bash
openssl pkcs12 -export -out forti_cert.pfx \ -inkey privkey.pem \ -in STAR_domain_com.crt \ -certfile STAR_domain_com.ca-bundle \ -legacy
Step 2: Upload the Certificate to FortiGate
Log into your FortiGate GUI.
Go to System -> Certificates.
(If Certificates is not visible, enable it under System $\rightarrow$ Feature Visibility).
Click Import -> Local Certificate.
Set Type to PKCS12 Certificate.
Browse for your
forti_cert.pfxfile and enter the password you set during export.Give the certificate a clear name (e.g.,
Wildcard_YourDomain) and click Create.
Step 3: Configure Portal Redirects via CLI
NOTE: For all the CLI commands, access the terminal from the button in the top right corner
Open the FortiGate CLI (via Web GUI SSH console or direct terminal) and run the following commands to enforce HTTPS redirection using your trusted FQDN and certificate.
1.Configure Portal Address FQDN:Global Redirect Mapping.
Set the domain name that FortiGate will present to captive portal users during redirection:
Plaintext
config firewall auth-portal set portal-addr "guest.yourdomain.com" end
2.Bind Certificate to Authentication Engine:SSL/TLS Handshake Configuration.
Instruct FortiGate to serve your custom uploaded certificate and force secure HTTP for guest authentication:
Plaintext
config user setting set auth-cert "Wildcard_YourDomain" set auth-secure-http enable end
Step 4: Verification & Testing
Connect a test device to the Guest / Captive Portal SSID/VLAN.
Open a browser and navigate to an unencrypted site (e.g.,
[http://neverssl.com](http://neverssl.com)).Confirm that you are cleanly redirected to
[https://guest.yourdomain.com/](https://guest.yourdomain.com/)...with a green lock / valid SSL status and no browser certificate warnings.
Frequently Asked Questions (FAQ)
Why is my FortiGate captive portal showing a certificate warning even with a public SSL certificate?
This occurs when FortiGate is still configured to use its internal Fortinet_Factory certificate for authentication redirection. You must run set auth-cert <Your_Cert_Name> and set portal-addr <Your_FQDN> in the CLI so FortiGate knows which certificate and domain to present to clients during redirection.
Why do I get an "Invalid Certificate" error when importing my .pfx file into FortiGate?
This usually happens if the PKCS#12 file was created using OpenSSL 3.0+ without backward compatibility enabled. Re-export your .pfx file using the -legacy flag in OpenSSL to ensure FortiOS can parse the file's encryption algorithms.
In case you have more questions and are still having trouble with setting things up, feel free to reach out to our support over chat in the bottom right corner, or by writing to us at [email protected]