Captive Portal

We have a monowall and are using the captive portal function with a ssl-certificate.
Our Monowall has a third NIC (OPT1) that is connected to a win2008 to authenticate the users in our AD.
This has worked fine for 2 years.
Until last week I needed to renew our SSL certificate.

When I installed the renewed certificate, web-browsers on client machines started to complain that it wasn't
a valid ssl-certificate.

I then tested to give a client machines a way through monowall. Next time the same client machines connects to monowall it said that this is a valid ssl-certificate in the browser.

So here comes the big question:

How does client computer validate a ssl-certificate when they are behind a monowall with captive portal and
need to login to access Internet?

Thanks in advance /Birger