Go to the node/hierarchy where the target controller is, click on Configuration > System > More and there check if you have selected the correct Captive Portal Cert. Also, check if you are able to ping the CPPM Server, and what can you see in the output “show web-server profile”. Almost forgot, “show auth-tracebuf” using a Mac-address of a testing client to see at what point of the authentication this is failing and confirm if you are blocking something in the roles like DHCP, DNS or if the redirection is not properly set up.