Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Cisco offers a WLAN system that allows admins to restrict WiFi access to authenticated users. However, the following statement bothers me:

  1. Use the secure

    .... A security alert window displays.

  2. Click Yes in order to proceed.

That security alert is a warning that the HTTPS certificate is invalid. As best I can tell, nothing prevents an attacker from setting up a rogue AP to phish passwords intended for login.html. Even more worrisome, if the attackers don't use SSL, Firefox is more likely to warn about a legitimate AP than a phising one!

Can anything be done here?

share|improve this question

To specifically answer your question, you need to install a valid SSL certificate under Security > Web Auth > Certificate on the controller's web UI. That will allow you to use SSL to authenticate users through the controller's captive portal.

This protects their password, but it doesn't protect the wireless traffic because the rest of the traffic won't be encrypted. For that, you should really look into using WPA2-Enterprise for your users.

share|improve this answer
How do you generate a valid cert for – jldugger Oct 15 '09 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.