nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

SSL/TLS certificates in a fresh ArcGIS Enterprise Builder install

BenO_Connor

Hello all,

After doing a base installation of ArcGIS Enterprise using Enterprise Builder 10.7.1 I notice the WebAdaptors are nicely using the domain certificate I configured in IIS. However I also noticed that the ArcGIS Server, Data Store, and Portal are using self-signed certificates (a different one each).

My initial question is if this is expected after an Enterprise Builder installation or have I gone wrong somewhere?

And then, if this is expected, is the best practice to reconfigure the Server, Portal, and Data Store to use the domain certificate? Or is there a reason to not reconfigure all 3?

Thank you in advance for any advice.

Kind regards,

Ben

Find more posts tagged with

Accepted answers

JonathanQuinn

In a base deployment, such as one created using the Enterprise Builder, there are 4 certificates as there are 4 separate web servers that require HTTPS communication:

1) The web server hosting the web adaptors - this will likely be a CA signed certificate, such as one from a well-known provider, (Digicert, Verisign, etc), or your domain certificate authority

2) Portal for ArcGIS

3) ArcGIS Server

4) ArcGIS Data Store

The last 3 certificates are created automatically by the individual components and issued to the common name, or CN, of the machine as a self-signed certificate. None of these are going to be trusted by the machine or any other machines in your network by default. You can configure each to use your own certificate if you'd like:

Configure ArcGIS Server with an existing CA-signed certificate—ArcGIS Server Administration (Windows) | ArcGIS Enterpris…

Import a certificate into the portal—Portal for ArcGIS (10.7 and 10.7.1) | ArcGIS Enterprise

ArcGIS Data Store command utility reference—Portal for ArcGIS (10.7 and 10.7.1) | ArcGIS Enterprise

It'd be up to you and your IT staff on whether you're OK with leaving the self-signed certificates. There is a convenience factor of setting up the web server certificate to use one that all machines trust by default as well.

All comments

MikeVolz

Can you point me to the documentation that showed you how to configure a domain certificate in IIS? I have gone through the base installation of ArcGIS Enterprise using Enterprise Builder 10.7.1, but I get the following error message:

JonathanQuinn

In a base deployment, such as one created using the Enterprise Builder, there are 4 certificates as there are 4 separate web servers that require HTTPS communication:

1) The web server hosting the web adaptors - this will likely be a CA signed certificate, such as one from a well-known provider, (Digicert, Verisign, etc), or your domain certificate authority

2) Portal for ArcGIS

3) ArcGIS Server

4) ArcGIS Data Store

Configure ArcGIS Server with an existing CA-signed certificate—ArcGIS Server Administration (Windows) | ArcGIS Enterpris…

Import a certificate into the portal—Portal for ArcGIS (10.7 and 10.7.1) | ArcGIS Enterprise

ArcGIS Data Store command utility reference—Portal for ArcGIS (10.7 and 10.7.1) | ArcGIS Enterprise

JonathanQuinn

The installation of the Enterprise Builder will set up IIS and the HTTP endpoint for you, but it won't configure the HTTPS endpoint. You need to do that yourself, which is likely what Ben O'Connor‌ has done.

BenO_Connor

Hi Jonathan,

Super! That clears it up for me. We'll most likely replace the self-signed certificates with the domain CA ones.

Kind regards,

Ben

BenO_Connor

Hi Michael,

Yeah, as Jonathan Quinn‌ suggested I had configured the certificate in IIS myself. I'm not sure if the below is the best way, but this is the process I followed to make a Windows Server 2016 machine ready for Enterprise Builder:

1) Enabling IIS and required components: https://enterprise.arcgis.com/en/web-adaptor/latest/install/iis/enable-iis-2016-components-server.htm

2) Asking our IT department to issue a certificate signed by our internal domain CA, for the target machine ArcGIS Enterprise was to be installed to. (they supplied a password protected .pfx format certificate)

3) Adding that certificate to the target machine's certificate store. (There was an "Import" option in IIS Manager > [MachineName] > Server Certificates, but I could have just double clicked the .pfx and followed the wizard)

4) Identified the "Default Web Site" in IIS Manager (this was the only website listed in my IIS so I assumed Enterprise Builder would automatically choose it).

5) Added a binding so that "Default Web Site" listens for HTTPS traffic on port 443 and uses the certificate I had just imported. I effectively followed ESRI's instructions in the Bind the certificate to the website from here: https://enterprise.arcgis.com/en/web-adaptor/latest/install/iis/enable-https-on-your-web-server-server-.htm

I had completed those steps before doing the Enterprise Builder installation. But I would guess it could be done at a later stage. Maybe someone else could comment on that.

MikeVolz

Ben:

Thanks for the very thorough response. I thought from the documentation as well as technical support that self signed certificates that are created for the Enterprise Builder would enable me to simply setup a portal using only the self signed certificates in a sandbox/development environment. Unfortunately as I have now learned the self signed certificates can be used for Portal for ArcGIS, ArcGIS Server, and ArcGIS Data Store, but not the web adaptors.

JonathanQuinn

Self-signed certificates can be used for the web adaptors as well, but you'd need to make sure any clients accessing the site trust those certificates, which is difficult to manage. So while it would work, there's a bit of overhead in working with self-signed certificates at the web server as well. The best approach is to use certificates that the machines that are going to access your portal trust by default.

ErikLash_HiCo

Also install Root and any Intermediate certificates that come from you CA signing authority in each of your GIS Enterprise software components.

Authorities like Go-Daddy use secondary signatories to do the work for them and if the Intermediate certificates containing the secondary signatures aren't installed into the chain, Trust won't be granted (in some instances but not all).

We have also found that ArcGIS Enterprise components have real problems ingesting Go-Daddy IIS formatted certs (.p7b) that come standard in Go-Daddy Microsoft certificate downloads.

To work around the .p7b problem in a MS server house running IIS our method for implementing certs:

- Install Root and Intermediate certs to the IIS Server machine using Microsoft Windows formatted certificates from the signatory.

- Install the .PFX on any web servers hosting Web Adaptors and any Gateway machines and configure HTTPS bindings in the web servers.

- Install Root and Intermediate to each Microsoft Server Machine OS on which the GIS Enterprise components are installed using the Microsoft Windows formatted certificates.

- Switch to the Linux formatted certificate package.

- Install Linux versions of Root, Intermediate, and PFX to each ESRI Enterprise software component that requires certs. Datastore only gets a .pfx.

Note in the diagram below from the 2019 ESRI UC that specific trust is required in any federated configuration. Switching to all Linux versions of the certificates used inside the ESRI software components themselves completely cleared up the SSL trust problems we'd been experiencing intermittently over several versions of the GIS Enterprise.

AndreaB_

Hi @JonathanQuinn and @BenO_Connor ,

This is fantastic information - thank you so much! I know the posts are 4 years old but they are helping me out.

I have a novice IT question - if I have 1 CA-signed Certificate from a past ArcGIS Server installation - can I use the 1 CA-signed certificate for all 4 of those locations - web adaptors, Portal, Server, and Data Store? (or do I have to get 4 different CA-signed certificates?).

Thank you!

Join the Conversation

Signed in members can post, follow updates, and more. New here? Register a free account.

Quick Links

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.