nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Questions about updating SSL certificates on 10.8.1

LLCCG

IT tells me that our SSL certificate is expiring soon and needs to be updated.

I have a HA system with Portal, Server, and Data Store each running on two machines.

I'm not really sure how many places I need to update these certificates, though.

In Portal Admin, when I go to Home > Machine > MachineName > SSLCertificates, each of the two certificates listed shows an expiration date of 2053. I'm assuming I don't need to update anything there.

In Server Admin, when I go to Home > Machine > MachineName > SSLCertificates, I have one that expires soon, and and a self-signed certificate that expires in 2053.

Is there any way to check the expiration date of the certificate for Data Store?

Is there any other place I need to check for certificates that expire soon?

I'm thinking that all I need to do is update the one in Server Admin that is expiring soon, and restart services, right?

Thanks!

Find more posts tagged with

Accepted answers

Scott_Tansley

Cool - you'd be surprised how many people install a cert but then leave that option as self-signed. So now you need to import your new certificate:

https://enterprise.arcgis.com/en/server/latest/administer/windows/configuring-https-using-an-existing-ssl-certificate.htm

into the first screen that you sent a screen grab off, and then update the entry above. Test, then delete the old cert.

I'm risk averse, so take a snapshot of the machine before you do it.

All comments

GraceSmith99

It sounds like you need to update the expiring SSL certificate in your Server Admin and verify if there are any other certificates in your HA setup that need renewal.

Verify Expiring Certificates in All Components

Portal: Since the certificates here expire in 2053, you don’t need to update them.

Server: You have one certificate that is expiring soon—this one must be updated.

Data Store: To check the certificate expiration date for the Data Store, run the following command on each machine hosting the Data Store:
```bash
openssl s_client -connect <datastore_host>:7443 -showcerts | openssl x509 -noout -dates
```
If this certificate is also expiring soon, it will need to be updated.

Additional Certificate Locations to Check

Load Balancer or Reverse Proxy: If your HA system has a load balancer (like Nginx, Apache, or an F5 device), it may also have an SSL certificate that needs to be updated.

ArcGIS Web Adaptor (if used): If you're using Web Adaptor in IIS or another web server, check if it has a certificate that needs renewal.

Updating the Expiring Certificate in Server Admin

Upload the new certificate in Server Admin.

Update any services that rely on this certificate.

Restart Services

After updating the certificate, restart the Server and any dependent services to apply the changes.

Your assumption is mostly correct—you must update the expiring certificate in Server Admin and restart the necessary services.

However, check the Data Store and Load Balancer to ensure there aren’t other expiring certificates.

If everything else is fine, updating just the Server certificate should be enough.

Kara_Shindle

If your IT dept misses a cert and it expires on the Web Adaptor machine and they replace it, do you need to register it somewhere for it to fix things? I've got some datastore issues I'm wondering if its because of this expired cert. Just posted about it here.

LLCCG

Yes, using the 6443 address. The date isn't in Server Manager, though, it's in Server Admin (server.domain.com:6443/arcgis/admin). It's under Home>Machines>MachineName>sslcertificates. When I open the two certificates listed, on is a self-signed certificate that expires in 2053, and the other expires in 2022.

Scott_Tansley

How do you access server manager? 6443 addresss? Alias name? Where are you looking at the date?

LLCCG

I see the one in Server Admin that is expiring soon. That one must have been installed in ArcGIS Server, right? Or is it just reading it from IIS?

Scott_Tansley

In many builds, it's just the Web Adaptors (IIS - for example) where certificates need to be replaced. It is obviously possible to install certs in the application components, but many organisations do not.

LLCCG

Yes

BillFox

do the 2053 dates correspond to self signed certificates?

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.