Captive Portal Certificate Failure After Firmware Upgrade

The RADIUS Access-Accept rules out bad credentials, a wrong shared secret, and most RADIUS policy issues. The failure happens after authentication, during the redirect or TLS validation, so the investigation should focus on the certificate chain and time. The most likely cause is certificate validation failure caused by the controller clock being 12 minutes behind and NTP pointing to a decommissioned server. A 12-minute skew can be enough to fail validity checks, especially if the certificate chain or OCSP response has tight time windows. The second likely cause is the firewall denying OCSP and CRL traffic. If the client or portal cannot check revocation, some clients fail closed and show a certificate error. The Let's Encrypt certificate being 85 days old is not expired, but it is close to the 90-day renewal window; if the certificate was renewed and the portal did not pick up the new chain, there could be a mismatch. That is less likely than the time and revocation issues, but it should be checked. A hostname mismatch is also possible if the upgrade changed the portal redirect URL or the certificate does not cover the guest-facing hostname. The fact that the portal page loads before login suggests basic DNS and HTTPS reachability exist, but the post-login redirect may use a different hostname or a stricter validation path. The troubleshooting order should be: correct time and NTP, verify the certificate chain and hostname, allow OCSP/CRL or use a certificate with stapling, then test the redirect.

First, fix time. Point the controller to two reliable NTP sources, allow UDP 123 through the firewall, and verify with a show command or the controller UI that the clock is within a few seconds of the portal and RADIUS servers. Do not rely on a single internal server. Second, inspect the certificate chain presented by the portal. Use openssl s_client -connect portal.example.edu:443 -servername portal.example.edu to view the leaf and intermediates, and check the notBefore and notAfter dates. Confirm that the hostname in the redirect URL matches the certificate SAN. Third, test revocation. If the firewall denies OCSP and CRL, temporarily allow the OCSP responder and CRL distribution point URLs in the walled garden, or enable OCSP stapling on the portal. If the organization cannot allow revocation traffic, use a certificate profile that does not require online revocation for guests, but document the risk. Fourth, reproduce the login from multiple client types, because iOS, Android, and Windows captive portal detection behave differently. Capture packets at the controller and client during the redirect to see whether the TLS handshake fails on the client or the portal. Fifth, check the RADIUS and portal logs for the post-authentication redirect URL and any error codes. Sixth, clear the client captive portal cache and test again. If the certificate is close to renewal, renew it and reload the portal service. Finally, verify that the walled garden includes the OCSP and CRL destinations, not just the portal hostname and DNS.

The immediate process control is a pre-upgrade checklist that includes NTP health, certificate expiry, certificate chain, hostname, and walled-garden rules. The team should monitor NTP offset and alert if any controller drifts by more than a few seconds. Use redundant NTP sources and avoid decommissioning an NTP server without updating all dependent devices. Certificate monitoring should alert at 30, 14, and 7 days before expiry, and the portal certificate should be automated with a renewal hook that reloads the service. The walled garden should explicitly allow the OCSP responder and CRL distribution point, or the portal should use OCSP stapling so clients do not need direct revocation access. Include a post-upgrade guest login test from at least two client operating systems, not just an association test. Test the full path: association, portal page, credentials, RADIUS Access-Accept, redirect, and success page. Keep a rollback plan and a known-good certificate backup. Finally, document the guest flow and the firewall rules so that a future firmware change does not silently break the redirect hostname or TLS validation.