Good point. However, browsers aren't the only applications that use HTTPS...
Reading draft-zhou-tls-server-redirect-00.txt, I'm I understanding it correctly that the "first" server must respond with the same certificate as the "second" server (e.g. the cert returned from the first server must match the Redirect URL hostname)?
A couple thoughts:
- This does mean any MitM can hijack, not just the local CP-NAS. This isn't unique to the proposed scheme, but I suppose ICMP is interesting to me because any "ICMP CP-Notification" packets can easily be filtered at the network level -- so, a CP-NAS can prevent an outside HTTPS MitM (using ICMP) from it's WAN side. It would be harder if the notification comes within the TLS handshake.
- If the CP-NAS ("first" server) must have the same certificate as the CP-WEB ("second" server), it does make the certificate a bit more vulnerable being in multiple places and could violate the cert license (which typically limit the cert to X number of machines). It is worth noting that the CP-NAS (often an AP itself) does not necessarily belong to the owners of the captive portal (take any hotspot services company as an example).
David