USG FLEX 200H — Trusted HTTPS certificate for the VPN 2FA portal

CVALLAT

Hello,

I’m using a USG FLEX 200H running firmware 1.38 with the Windows built-in IKEv2 VPN client, local user accounts and Authenticator-based 2FA.

The VPN works, but the HTTPS page where users enter their 2FA code presents the factory self-signed certificate, causing a browser security warning.

I would like to use a dedicated hostname, such as mfa.example.com, with a publicly trusted certificate.

Your FAQ mentioned that custom certificates for the 2FA portal were planned for firmware 1.37:

Could you clarify:

1. Is this supported in firmware 1.38?
2. Is there a supported GUI or CLI procedure to assign a certificate specifically to the VPN 2FA portal?
3. Does the “Captive Portal Server Certificate” setting also apply to this page?
4. If this is not supported yet, is there a confirmed target firmware version?

I want to keep HTTPS and the Windows built-in VPN client, without a reverse proxy or additional VPN application.

Thank you.

https://community.zyxel.com/en/discussion/30048/why-cant-i-configure-a-certificate-for-2fa-web-portal