Refer to the exhibit. An engineer is configuring WebAuth on a Cisco Catalyst 9800 Series WLC. The engineer has purchased a third-party certificate using the FQDN of the WLC as the CN and intends to us

When a client is redirected to the WebAuth splash page, their browser attempts to establish an HTTPS connection to the WLC's virtual IP address. For the certificate to be trusted and avoid security warnings, the hostname presented by the WLC (its Virtual IPv4 Hostname) must exactly match the FQDN specified in the Common Name (CN) field of the installed third-party certificate.

While the Virtual IPv4 Address must be routable for clients to reach the WLC, configuring it as such does not resolve certificate name mismatch errors.

Web Auth Intercept HTTPS forces HTTP traffic to be redirected over HTTPS, but it does not address the issue of a certificate hostname mismatch once the HTTPS connection is initiated.

The trustpoint is where the certificate itself is managed and stored on the WLC, but simply setting it to a management certificate does not configure the virtual hostname to match the purchased certificate's CN.