It would be our Checkpoing Firewalls doing the https inspection...
We did consider the fact that a user would first have to install a certificate on their device, but we are offering them free internet access.. so we thought it a fair trade off!
So Im haping that on the Captive Portal registration page, we can simply have a link to the cert, which is hosted on Clearpass (rather than another external system), thich they can install as part of their registration.