XG Firewall and BYOD WiFi on VLAN in a school

So essentially clients should do the redirect to the portal. But this can break, if the certificate of the website is not valid/trusted. Therefore you should make sure, the redirect of the Captive Portal is reachable and has a valid cert. You can decide in Admin settings, if you use a URL or a IP for this. 

Thanks for the reply, we do have a certificate for the URL, which has a green tick to say it is verified. It is also Globally signed by RapisSSL.

When we browse internally to the URL via HTTPS on a windows device, IOS or Android it loads with no errors and the certificate is valid.

The admins settings for the portal as below... 

Thanks for the reply, we do have a certificate for the URL, which has a green tick to say it is verified. It is also Globally signed by RapisSSL.

When we browse internally to the URL via HTTPS on a windows device, IOS or Android it loads with no errors and the certificate is valid.

The admins settings for the portal as below... 

That is the not the admin settings. 

Check: 

Sorry, I thought you meant the Authentication page, I have checked the main admin settings as well and looks correct...

And this hostname, you are using. Is this the hostname, somebody can publicly resolve? 

Ah, right, support didn't tell me that.

Back to square one!

Thanks

Let me put something in perspective: 

You are using a Hostname for the firewall and the firewall is using a Certificate for this hostname. 

Let say: XG.customer.local

if a client connects to your firewall, it will do the check to get the captive portal. If this resolves to XG.customer.local, it will ask the DNS (which could be the firewall or not). The IP will be resolved and connected to. 

In case of connection, the firewall will use the hostname, the client was provided. So you could have a problem here. Internal DNS is not resolving to the original IP. 

Thanks for staying with me on this, I really appreciate it as this is outside of my understanding, but I have setup the following.

The firewall is know internally as XG.int.domain.com (int is our internal sub domain and not externally resolved)

The Firewall has two internal IPs Corporate - 10.0.0.XX1, WiFi 10.0.40.xx1, both IPs are resolved internally via internal DNS

The external IP does not resolve to that url. 

The CSR was made with the two internal IPs and the internal URL.

So would the best practice be that I need to rename it to XG.domain.com, create a new CSR for the two internal IPs and the external IP, and add the host name to the internal DNS for the two internal IPs?