Guest Onboarding Failure After Certificate Renewal
A hospital runs ClearPass 6.11 with a guest self-registration portal at guest.example.org. The portal uses a publicly signed TLS certificate that expired at 02:00. At 06:15 the helpdesk reports that guests reach the registration page but the 'Create Account' button spins indefinitely and no account appears in the Guest database. RADIUS authentication for staff EAP-TLS is unaffected. ClearPass event logs show repeated 'HTTP 500' entries on the guest portal service, and the Access Tracker shows no guest authorization requests arriving. The guest SSID uses a captive portal profile pointing to the same URL. The network team confirms DNS resolves correctly and the firewall allows 443 to the ClearPass publisher.
1. Given the symptoms, what is the most likely failure point, and why is RADIUS unaffected?
Read the worked answer
The failure is at the guest portal's HTTPS/application layer, not RADIUS. The expired certificate breaks the browser's trust chain: modern browsers may still display the page but block or fail the XHR/POST to the registration API, and ClearPass's own service can throw HTTP 500 when the portal service's TLS binding is invalid. RADIUS EAP-TLS for staff is a separate service listener (UDP 1812) with its own certificate chain (the EAP server cert), so it continues normally. Key discriminator: no guest authorization requests in Access Tracker means the request never reached policy evaluation - the break is before RADIUS. Fix: renew/replace the HTTPS certificate on the portal service, rebind it, and restart the portal service; then re-test registration end-to-end.
2. How would you validate the fix without disrupting production staff authentication?
Read the worked answer
Validate in layers: (1) Confirm the new certificate chain with an external TLS checker (valid dates, full chain, hostname match). (2) From a guest VLAN client, load the portal and confirm the registration POST returns 2xx and a row appears in Guest. (3) Confirm an Access Tracker entry now shows the guest MAC with the correct service and role. (4) Verify staff EAP-TLS still succeeds by testing one known-good supplicant - do not restart the EAP listener unnecessarily. Use a maintenance window or a single test guest device rather than a broad SSID change, and keep a rollback of the previous certificate binding.