Feature Request: Hotspot HTTPS redirection problem!!!

many of mikrotik hotspot distributors would be more than happy if you had an option to catch ALL pages including the HTTPS ones and redirect them to the captive page portal without any errors. Several other way less smart hotspot systems can do it… I believe that mikrotik could provide that as an option as well.

I personally have more that 400 mikrotik hotspot installations that would appreciate it!!! :slight_smile:

I would be also quite happy if they would implement it!

Wait, and how to those other systems intercept HTTPS requests without an error in the user’s browser? TECHNICALLY speaking? Can you give an example of such a hotspot system?


(What you can do right now in RouterOS about HTTPS connections is to either force users to install a certificate of yours, and thus avoid the browser warning OR you could block all HTTPS connections, except those to your hotspot, which would give people an error message that makes it seem like they don’t have any internet connectivity, which is somewhat true anyway, but isn’t your hotspot login page)

http://forum.mikrotik.com/t/https-problem-on-hotspot/74093/1

In a nutshell:

SSL is designed to stop man-in-the-middle attacks, which is what transparent hotspot redirection IS.

If you could silently redirect an SSL connection to an arbitrary website without generating alarms, then so can hackers.

Fortunately, most modern devices and operating systems will check to see if the network is behind a captive portal as soon as they’re connected, and if it is, they’ll just open a browser to get the portal page…

If you really want to avoid the portal page then use MAC address authentication. It happens automatically whenever a user’s MAC address shows up in the Hotspot hosts list, and if successful, it will keep the user from ever being redirected at all if they’re authenticated.

HTTPS redirection already happens in mikrotik hotspot, however, because of the way certificates work, users will get a scary warning on their browser regarding of invalid certificate and they need to accept it before they get redirected to hotspot portal page. It is possible to completely block port 443 for unauthorized user to avoid this problem, however, it would also cripple Walled Garden rules on port 443. what i suggest, is another option to only allow port 443 for unauthorized users if it’s not going to be intercepted (As in there is a rule for it in Walled Garden (Not to be confused with Walled Garden IP)).

Enjoy reduced usefulness of transparent http(s) redirection portals as time goes by and more of the web defaults to SSL-only.

At least modern operating systems test for captive portals and just pop up the login screen…