FEDERATION - Unable to validate TLS certificate (10.9.1)

Question

Just upgraded a single machine base deployment from 10.7.1 to 10.9.1.  Everything was successful, but I receive the following error message when attempting to validate the federated server

* Error: Unable to validate TLS certificate on ArcGIS Server administration URL. Ensure the root certificate is trusted or the certificate common name matches the URL hostname.

I am using the exact same certificate that was being used without issue before the upgrade.  I confirmed the root is trusted on the machine, and it is a wildcard cert so the 3rd part of the of the error message does not apply.

Why would 10.9.1 not like this cert if it was valid  for 10.7?  is there another step I am missing to complete the federated server validation process after an upgrade?

I am able to access server admin, portal admin, and portal home without issue, but server manager will not load after the sign in page.

feralcatcolonist_old · Answer

We're using a wildcard certificate like *.domain.com and are getting this error:

Unable to validate TLS certificate on ArcGIS Server administration URL. Ensure the root certificate is
trusted or the certificate common name matches the URL hostname.

What do other people with wildcards do?

EDIT:
For anyone playing along at home; we ended up having to upload our intermediate and root certificates. I actually don't know how to do this the button-clicking way we configured ours in the ArcGIS PowerShell DSC.

uriedc_mike · Answer

Hi Tim,

Thanks for the posting your error message.  I had the same issue.  In our case it turns out that the common name url (server name) in the server cert does not match the server name.  A new ssl cert needed to be requested by our IT dept with the correct server name url.  Hope this helps.

Scott_Tansley · Answer

have you done a CTRL + F5?  Have you tried inPrivate mode to enter Server manager? Sometimes you can get cached items stuck in the browser that block things.

If you have then my guess is that it's to do with the certs.  I'd delete the CA signed certificates from portal and server, using portal/server admin, and then reload them.

There are times, and I'm not saying this is one, where AD policies enforce things in company browsers that make issues like this hard to resolve.  Having a 'clean' laptop, if IT will let you have one may be a useful test.