nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Getting Error when trying to set up Reports from the Survey123 Website (with our ArcGIS Enterprise Environment)

GregDunnigan

Asking this here in case anyone has a quick answer...have a ticket into ESRI Support as well.

First, this had been working previously. Last successful report generation was 5/26.

When trying to run a report from the Survey123 Website, we are are getting the attached error regarding:

'SSL routines:final_renegotiate:unsafe legacy renegotiation disabled'

We get this error when trying to run a report, and when trying to add a new Report Doc Template file. Full screenshot of error message in attached picture.

Error.JPG

Encontre mais publicações marcadas com

Accepted answers

All comments

ChrisBeaudette

Our "final" solution to this was to install the Survey123 Website "locally" on our web adaptor servers that sit in front of our ArcGIS Enterprise stack. So we are no longer accessing survey123.arcgis.com at all. It's a pretty simple installation and turned out to be much simpler than any other alternatives.

That said, the Survey123 website is about to have an upgrade released (v3.19) which may end up having the same OpenSSL3 version issue that the current survey123.arcgis.com website has. We installed v3.18.54 and will probably keep it at that until we have a good reason to upgrade or we have resolved the secure renegotiation in our Enterprise stack, which ever comes first.

Sehafiz

Hi @GregDunnigan,

I asked our IT department if there is any way to enable that Secure Renegotiation without upgrading Windows Server. They did help us. NetScaler was being used as Reverse Proxy for our Portal site. Instead of NetScaler, our IT Department placed Azure Front Door as the Reverse Proxy.

This resolved the issue.

ReggieSanders

Still dead in the water I talked a little with one of our ESRI reps and he had some ideas of maybe fixes but they seemed pretty involved and probably going to have to our IT department pulled in.......not looking good honestly but well see I guess

ChrisBeaudette

@ReggieSanders we'd be interested to know if you're living with this issue or working around it, and if working around it how you did so.

ChrisBeaudette

We have a couple of different workflows that both go through survey123.arcgis.com: one from a web client and one from PowerAutomate. For both we are implementing server-side workarounds that involve accessing the survey data in an enterprise geodatabase from either PowerBI or an automated python script using arcpy.

To be clear: this is occurring due to the hosted survey123.arcgis.com solution (running in NodeJS) getting an upgrade that uses OpenSSL3, which requires that secure renegotiation be configured for any requests that it makes to external resources. That is, where survey123.arcgis.com is the client making https requests to external servers. If one of those external resources is your ArcGIS Enterprise software stack then you either have to put a load balancer that supports secure renegotiation in front of your ArcGIS Enterprise deployment, or wait for Esri to release a patch for ArcGIS Enterprise where its stack supports secure renegotiation, or use a workaround (server-side or otherwise).

We have approached Esri on a few fronts and are working with their professional services team to provide an ArcGIS Enterprise solution to this issue.

GregDunnigan

@ReggieSanders @Sehafiz Were you ever able to find a work-around for this besides giving up on Survey123?

Andrew-Bowne

Have you checked your cert chain using: https://www.ssllabs.com/ssltest/analyze.html ?

ReggieSanders

Was there a work around to this yet? Was working fine in June. Now running into the same issue.

Sehafiz

Hi ZacharySutherby,

I am wondering if you got any solution to the issue? We are having same issue and we are using ArcGIS Enterprise 10.9.1 on Windows Server 2019 that does not support TLS 1.3.

ZacharySutherby

Hello @ChrisBeaudette,

We are in contact with Support and have passed troubleshooting next steps to the analyst.

Thank you,

Zach

ChrisBeaudette

Hey Zach.

We have not had any movement on this issue from tech support since June 16. Are you working with them on this by any chance? Could we have someone review and update the support ticket?

Thanks,

Chris

ChrisBeaudette

Hi Zach.

We're not getting a jobID in the response -- we only get the error that is being reported to the UI:

{
    "error": {
        "message": "request to https://<PORTAL WEB ADAPTOR ROUTE>/sharing/rest/portals/self?f=json&token=BIG_LONG_TOKEN failed, reason: write EPROTO 68A17530C87F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:ssl/statem/extensions.c:893:\n",
        "code": "EPROTO"
    },
    "success": false
}

I'll provide additional information in the support ticket that will enable you to reproduce the issue against our portal. Let's continue the conversation via the support channel.

Thanks,

Chris

ZacharySutherby

Hello @ChrisBeaudette,

Thank you for confirming! That is perplexing based on the error received that points to the secure renegotiation being the issue. Would you be able to try generating a report from https://survey123dev.arcgis.com and pass along the jobID for the request to the Support case you have open. We have found the Support case you have open and are in communication with the folks in Tech Support on the issue.

To access the jobId you will need to capture the web traffic when you select the Generate button in the Report pane. You will see a submitJob request and in the Response to that request you will see a jobId. With this jobId we can check out internal logs to see if there is additional information as to why the error is being returned.

ChrisBeaudette

This is happening in our Production system which v10.9.1 and our UAT system which is v11.1.

Alison_Gou_

Hi @ChrisBeaudette , do you mind sharing your ArcGIS Enterprise version to help investigating? Thanks.

ChrisBeaudette

Also this is what the SSLLabs analysis tool reports (which seems to indicate that secure renegotiation is supported? But it also reported an error immediately before so not sure if this is conclusive):

ChrisBeaudette

Thanks Zach.

I work with Greg and we're attempting to remediate this issue.

Can you advise on what needs to happen on our end in order to support secure renegotiation? If it helps our portal URLs are hosted in F5 endpoints.

Thanks,

Chris

ZacharySutherby

Hello @GregDunnigan,

If you enter your Portal URL into https://www.ssllabs.com/ssltest/analyze.html (check on the box "Do not show the results on the boards") and run the test you will likely see that Secure Renegotiation may not be supported. If this is the case when the ArcGIS Survey123 Report API is trying to reach out to your ArcGIS Enterprise organization since Secure Renegotiation is not supported the Survey123 Report API is not trusting the connection.

With our 3.18 ArcGIS Survey123 release that went live earlier this week we had updated some of the node libraries used in the Report API and this is resulting in the more strict security standards.

We are working on our communication and path forward with this requirement.

Participe da Conversa

Membros conectados podem postar, seguir atualizações e mais. Novo aqui? Registre uma conta gratuita.

Links Rápidos

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.