OK, it seems you are right. SPF is the only mechanism that is really useful in TXT records while everything else is for humans primarily.

I don't Know if any of you even considered what HSTS does, but effectively it kills any attempt of solving this issue whether you have a valid hotspot certificate or not! Look it up on Wiki and you will understand why I believe this cannot be solved on HTTP(s)level. But maby we can solve this nightm...

Is it possible to issue a certificate per IP address? I don't think that "StartSSL" CA has this service. Don't Know about Comodo either.

The client first makes a TCP connection to google on port 443 which get intercepted. The client is not aware of this interception. During the SSL handshake the the router is presenting it's own certificate which is obviously not issued for "google.com" but for "myhotspot.mydomain.com...

You can't "resolve" this issue as it's how https works. The certificate is to prove your identity. When you interrupt a connection from the client to a https website you are NOT that website therefore the client will show a warning. Please see also my post http://forum.mikrotik.com/viewto...

Hi ! I did this and my certificate is working good on the hotspot login page but I still get the Certificate warning if a Hotspot client has his browser set to open https://www.google.com or any https website... I already put the certificate in www-ssl in "services" too. Does someone has ...

IKEv2 for IPSec

I need this too for easy VPN from Windows Phone 8.1

Zvjer, Go to IP > Services and enable www-ssl. Then go to IP > Hotspot > Server Profiles and click on your profile. Then check "HTTPS" under "Login By" No, it does not work properly. The truth is that I have not had www-ssl enabled before you told me to, but after enabling it (a...

You can not buy a certificate to a local IP. All certification's companies require a public IP or public DNS. While what you say is true, there is another way: You can go to www.startssl.com and get yourself a FREE level1 SSL certificate for your domain (whoich must exist) and use that DNS name for...