Hi all!
I am using Mikrotik Router v5.20 on x86. The Mikrotik is essentially used for managing users via an embeded hotspot. I have two type of users.
A group 1 which autheticate via their mac addresses and a group 2 which authenticate via a radius server. For the second group,
they only have access to the Internet through a login page.
I only have problems with the second group of users.
If the default page on their browser is secure for instance https://www.thewebsite.com they will not have access to the portail ( login page).
Only an error saying that they cannot browse.
And I really do not know how to fix that.
Need your help and assistance.
Thank you.

I also discovered this problem and apparently there are no REAL solution to it. From my research in this forum, found out that because mikrotik hotspot is unable to redirect https connection to hotspot login page. This is problem with https protocol and proxy. Cause hotspot login redirection is some sort of transparent proxy.

Your solution would be:
1) leave it as is. Not many people use https as their first login page anyway.
2) change hotspot login page to use HTTPS. However, doing this require you to buy SSL cert. For self generated cert, your browser will prompt you of self-generated cert error.

I am choosing solution 1 on my side.

I changed the hotspot login page by using HTTPS with a SSL cert. But the issue still remains.
Believe me, I do have many people using https as their login page.

Please, I want to know how to create a VPN server on mikrotik (step by step).

This problem basically has no solution. And it only got worse as Google now defaults to https.
Hotspots work in a kind of intrusive way, and HTTPS is secure enough to prevent this and other intrusions.

Even if you redirected HTTPS, which can be technically done, it would fail at verifying the certificate.
Buying a certificate wouldn't help because the browser expects Google's certificate and no other.

No good workarounds, but here's some ideas:
- Educate/inform users to start at the ISP website instead of google.
- Allow google queries (in walled garden), and hope that user will then jump to an insecure web site to get the hotspot redirect.
- Create a self-signed root certificate, redirect HTTPS, and force your users to install it. You really do not want to do it unless users are your emloyees, but then they shouldn't be connecting through a hotspot in first place.

No good workarounds, but here's some ideas:
- Educate/inform users to start at the ISP website instead of google.
- Allow google queries (in walled garden), and hope that user will then jump to an insecure web site to get the hotspot redirect.
- Create a self-signed root certificate, redirect HTTPS, and force your users to install it. You really do not want to do it unless users are your emloyees, but then they shouldn't be connecting through a hotspot in first place.

That does not apply to public places. Who has a solution, please - post it.

anyone already have a solution for this problem?

Hotspot doesn't redirect to login page from https:// pages

I think that covers it.

Think about it. Would you like someone like me redirecting your banking secure site to mine? I'll do your banking!

anyone already have a solution for this problem?

+1

hi friends,


me to have the same problem...

We have +200 free wifi hotspot and lot of clients with apple gears have problems. Normal user think is a wifi problem, it's hard to explain that is a safari issue.

MT guys any ideas?

Thank You Giuseppe

In case of access to https://google.com only there is a DNS-based, special solution on LINUX. However, do not know about
the chance to do the same on RoS.

@server8:
Pls, mail me at augustus_meyer@yahoo.de because of some commercial coop.

Can any one there have an Idea why most android devices are not working in my Hotspot?
they connect quite alright with and IP from my DHCP. but the login page will not appear for them to continuous.
I have been having this problem. but theses divices are working on other Hotspot around.

Please Help

Hmm, i have the same problem. Lots of pages are https. so the problem is always there.
who has a solution for this. Mikrotik maybe?

I have a certificate on the login page. Everything works fine.. But with the mikrotik hotspot functionality he wants to the real page like Google. And that doesnt work.
Whitelisting is not an option.


greetz
Bart

Try to enable HTTPS login page on your HotSpot for proper HTTPS redirection.

hello, i tried it.. but i got the IE and firefox message :
the page cant be displayed.
make sure TLS and SSL protocals are enabled (they are)

he is searching for a certificate from (example) google.nl ... but he cant find it because he cant go to it thru the firewall....

Hi,

i'm looking for the same solution.
With Mikrotik 951 2n and hotspot active when some user attach to the wifi and surf the net with a https://
an error apears and doesn't redirect to de login page. The redirection is working perfect with http://

Seams a bug that has to be fixed ?

By the way, may is not the correct place to post (if not let me know or answer throw private) i wold like to test
a hotspot (outside mikrotik) and hosts a hotspot software to use with "any" kind of router ... Wich one to use ?

Thank's a lot.
Oscar.

I found the solution for my problem.

i installed the certifcate (.cer) on the mikrotik and FORGOT the .key certificate installation.
I installed also the CA certificates.
i checked the HTTPS at the hotspot settings.

Now the https login page is visible for everyone.

Hi,
I would like to know If you use an external login page?
I mean, the mikrotik login page redirects to an external https page?
I have a problem of https redirection, I already have an SSL for my external login page.

Hello,
we use the externa loginpage.
Could you explain your settings?

I'm aware that I need to have an SSL certificate on my login page so that mikrotik can successfully redirect login pages.
However, even installing the certificate on the website and now that the page is in https mode, users connecting via the hotspot are still getting SSL Error pages.
Although once they accept the certificate, it goes fine, I want to remove the SSL error page.

Any help on this?

ah oke i understand.
thats no possible. because someone go to httpS://google.com en he want the certificate of google.com. he cant get it.

thats why you need to accept this.

any chance to somehow redirect google in dns to nosslsearch.google.com ?