ArcGIS Enterprise on development Server

Question

Hi all,

I have successfully installed ArcGIS Enterprise 11.1 on a single machine on a Production server. It has GIS Server, Portal, Data Store (relational and tile cache), 2 web adaptors, and Image Server. It has a CA-signed Certificate on all of the apps and is open to the public through an F5 and using DNS address and Portal is configured to use a WebContext URL.

I am now setting up a GIS development server. I am going to install ArcGIS Enterprise 11.1. However, in dev I'm not going to have a CA-signed certificate, nor is it going to be open to the public through the F5 or have a DNS address.

So what are my steps in this scenario? For example, I am to the step that says "enable HTTPS on your web server" so in Prod I used the CA-signed certificate. What do I do here? Maybe I don't do this step?

And later when I used the DNS address in Prod, I think here I would just use the machine name.

I appreciate any help and ideas. Thanks!

Aled Wyn Jones · Accepted Answer

This is a good question - in your dev environment, you could skip this step but keep in mind that you may receive "unexpected behaviour" as per: https://enterprise.arcgis.com/en/portal/latest/administer/windows/scan-your-portal-for-security-best-practices.htm#:~:text=To%20help%20reduce%20web%20browser%20warnings%20or%20other%20unexpected%20behavior

This may show itself as issues with printing secured content.

A workaround would be to import (on the dev client and Enterprise machine) either the default selfSignedCertificate or your own self-signed cert as shown in this article: https://enterprise.arcgis.com/en/server/latest/administer/windows/configuring-https-using-a-self-signed-certificate.htm

under the "Import the certificate into the OS certificate store" section.

Regarding DNS, as a workaround, you could use a host file like this on the Enterprise machine:

mymachine.dev.com    10.0.0.1

madeupDNS.dev.com    10.0.0.1

Make sure the ArcGIS Server doesn't rename itself to "madeupDNS.dev.com" https://developers.arcgis.com/rest/enterprise-administration/server/renamemachine.htm#:~:text=Version%20Introduced%3A10.1-,Description,machines%20undergoes%20a%20name%20change.

Your client machine in dev would need a host file like this:

madeupDNS.dev.com    10.0.0.1

Then you can config Portal webcontextURL etc. I'm assuming you have 1 Enterprise machine and 1 Client machine in your dev - you would have to do this for every client machine which isn't ideal.

I'd urge you to make sure you have a test environment setup like your production - hosts files can introduce some weird and wonderful conditions which I try to avoid wherever possible.

In an ideal world, you would have another domain/subdomain for your dev environment and access to a CA certificate

Aled Wyn Jones · Accepted Answer

Hi @AndreaB_,

Sorry for the slow reply - it's not recommended to include your machine names as a SAN in your certificate. This will expose the machine names of your deployment and is generally a information security risk.

The cert with your friendly DNS alias should be configured with your web server solution (IIS and web adaptor for example) and should only certify https://myfriendlyDNS.domain.com/portal

If you want to certify machine endpoints e.g. https://myPortalmachine.domain.com:7443/arcgis/portaladmin then I would suggest creating another certificate for this endpoint which only includes the machine name on the certificate.

With the config I just explained above, you could use your wildcard certificate freely on your Web Server solution between dev, test and prod without having to worry about the SANs. You will have to maintain the certificates for the machine separately though - once you've done it a few times it becomes a very quick job 🙂