nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Unable to replace Data Store SSL Certificate

WilliamRice

I am attempting to replace the Data Store self-signed certificate with my commercial certificate using the Data Store "updatesslcertificate" utility. When I run the utility, I receive the following error: "Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate'. My certificate is in the .pfx format and was imported into and is being used successfully with Portal and Server so I don't believe there is anything wrong with my commercial certificate. I am not finding anything to troubleshoot this particular issue.

タグ付けされた投稿をもっと見る

Accepted answers

All comments

Shaun_Weston

Hi there,

This could be related to the syntax used in the command. If the certificate password has spaces in it, need to enclose it in quotation marks.

e.g.

"E:\ArcGIS\DataStore\tools\updatesslcertificate.bat" E:\Certificates\servername.local.pfx "password goes here" servername.local

or could be this - https://support.esri.com/en/technical-article/000026043

Todd_Metzler

Confirmed again. Problem unresolved and still exists in Enterprise 10.8.1 with all patches applied as of 2021-03-31.

What we need is a updatesslcertificatewithsamealias.bat or removecertificate.bat Esri. At least update the documentation to include the solution in this thread.

ChrisBlakely

This bug is still present at version 10.8.1. Thanks to this thread we are able to work around it (changing the alias), but agree that this bug should have been fixed long ago.

NiekGoorman1

Thanks Fabian - this was a very useful bit of knowledge as it's still affecting me at 10.7.1. Changed the password to exclude special characters and used a new alias. Bugs like this really should not be present at all, and certainly not after another major release of the software. How did this get past QA?

WilliamRice

Ok. Thanks for sharing what you found out and your work around.

FabianMeyer

I know this is an old issue, but it concerns us every three month because we regulary change the SSL certificates of our Enterprise site (Let's encrypt certs). I find out that you can't update the certificate, if you use the same Alias. If you try so, it will return the error message mentioned above. So I change the Alias everytime I update the SSL certificate by adding a counter to the Alias and everything is ok.

Just want to share this workaround-

JonathanQuinn

I think there are a couple issues here, the first being that the certificate can't be imported, which may be a bug as RdekMappingRdek Admin‌ has described.

The other is, as the OP initially mentioned, the logs/error message don't indicate the problem. If you ever get back to this, I'd suggest logging another bug that the error message should tell you why the operation failed, not just that it failed.

"Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate' doesn't tell you much.

RDEKAdmin

Hi,

We had this issue as well (ArcGIS Enterprise Builder 10.6) but Esri Support was able to provide the following info:

Here's the known bug: [BUG-000114816 : ArcGIS Data Store 10.6 will fail to update it's SSL certificate if the certificate's privacy key has special characters within it.] This problem occurs for Portal for ArcGIS as well, so I would imagine this also occurs in ArcGIS Data Store.

Re-creating our certificate .pfx file with a password that only contained alphanumeric characters solved the problem.

Note that the server we had issues with was running Windows Server 2016. The certificate (with old password containing alpha-numeric characters) updated without issue on a different server running 2012 R2.

WilliamRice

Theodore,

No, the issue has not been resolved yet. Andrew Valenski above offered to provide some additional troubleshooting steps. Due to the black box nature of the Data Store, Esri's tech support solution was for me to completely reinstall all of the components of ArcGIS Enterprise. The parts of ArcGIS Enterprise 10.6 we are currently using are working just fine. I had to put this issue aside for the moment because I had to move on to some other tasks. Likely I will need to revisit this issue again in the very near future.

TheodoreDean

Has this been resolved ? I think we are facing the same problem with 10.6

Anonymous User

Wait, are you running a 10.6 Enterprise stack on a 2006 server?

WilliamRice

Andrew,

I am running the updatesslcertificate using a Windows Domain Account that is a member of the Local Administrators Group on the location machine. I am running the command while logged into the machine via Remote Desktop. This Domain user account is the same account that was originally used to install Portal for ArcGIS, ArcGIS Server, and Data Store on the machine. The machine is running Windows 2016 server with IIS for the webserver software. When I go into the Microsoft Management Console (MMC) Certificate Manager, I see my commercial certificate issued for the machine listed under Certificates (Local Computers) > Personal > Certificates. Under Trusted Root Certification Authorities > Certificates, I see four Root certificates listed for the commercial certificate vendor.

Anonymous User

And are you running this from an admin account from the machine that ADS is installed on?

I'd also confirm that the certificate you are using is added to the machine's trusted root certificate store on the machine where ADS is installed

WilliamRice

Using ArcGIS Server Manager, I am not seeing any errors generated in the log files for the Data Store. I am just seeing the error message "Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate' when I run the Data Store "updatesslcertificate" utility.

The only other item I have noticed is that every time I run the "updatesslcertificate" utility, a file of the form "agsdatastore.ks.20180424011020477" gets generated under the Data Store C:\Program Files\ArcGIS\DataStore\etc\ssl directory and that the update date of the agsdatastore.ks file does not change.

--Will

WilliamRice

I am using ArcGIS Enterprise version 10.6 with also the latest patches applied.

Will

BillFox

Hi William/Andrew,

There's a BUG on that in 10.5 data store

What release are you using?

-Bill

Anonymous User

Could you provide some more information? Perhaps the error logs for the datastore?

会話に参加する

サインインしたメンバーは投稿、更新のフォローなどができます。初めてですか？無料アカウントを登録してください。

クイックリンク

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.