Which is really shit. All you need is a genuine cert on the landing page. It's lazy design for the wifi portals. Our guest wifi needs a landing portal for its voucher info. It has a letsencrypt genuine cert. Onsite DNS handles the internal redirecting , external dns obviously goes nowhere. Cron job handles the recert process every 45 days.
Client with a moderately recent browser gets no cert errors.
Biting the hand that feeds IT
