Hi,
Can you please explain in details where are you facing the issue?
From high level steps,
1) User connects to WiFi and is placed in initial role, gets redirected to ClearPass Guest Portal. Here they get the certificate from ClearPass.
Are you reaching this step? If not, did you select External Captive portal profile and select your right profile?

2) Users completes the registration and presses login. ClearPass will instruct the client where to post back. This is the IP address/FQDN specified on ClearPass under the guest login page.
3) Client's device will postback to this URL (which is for the certificate hosted on the IAP / controller)
4) After that NAS will send a Radius Request to ClearPass to complete the authentication

Where is it failing?