Captive Portal Prevents client fron Accessing CA root authority before login

[rm]

So I read through a few cert related posts and can't find what I think is happening. I installed a third party wildcard cert (Comodo) that I had and it works except for pre logon.

Error is the client can't reach the root CA to verify the cert authenticity. Installed the intertmediate certs on PFSense to no avail. Not sure what 'Disable HTTPS Forwards' is supposed to do but behavior seem to be the same regardless, cert warning. Once network access is established Cert checks out fine. Should the intermediates be doing something for the chain or can a firewall rule be made to bypass the portal for Comodo comunication?

Thx