topic Re: Unable to replace Data Store SSL Certificate in ArcGIS Enterprise Questions

Unable to replace Data Store SSL Certificate

WilliamRice — Sat, 21 Apr 2018 16:46:47 GMT

I am attempting to replace the Data Store self-signed certificate with my commercial certificate using the Data Store "updatesslcertificate" utility. When I run the utility, I receive the following error: "Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate'. My certificate is in the .pfx format and was imported into and is being used successfully with Portal and Server so I don't believe there is anything wrong with my commercial certificate. I am not finding anything to troubleshoot this particular issue.

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Mon, 23 Apr 2018 21:21:51 GMT

Could you provide some more information? Perhaps the error logs for the datastore?

Re: Unable to replace Data Store SSL Certificate

BillFox — Mon, 23 Apr 2018 21:36:20 GMT

Hi William/Andrew,

There's a BUG on that in 10.5 data store

What release are you using?

-Bill

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Tue, 24 Apr 2018 01:01:30 GMT

I am using ArcGIS Enterprise version 10.6 with also the latest patches applied.

Will

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Tue, 24 Apr 2018 01:29:46 GMT

Using ArcGIS Server Manager, I am not seeing any errors generated in the log files for the Data Store. I am just seeing the error message "Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate' when I run the Data Store "updatesslcertificate" utility.

The only other item I have noticed is that every time I run the "updatesslcertificate" utility, a file of the form "agsdatastore.ks.20180424011020477" gets generated under the Data Store C:\Program Files\ArcGIS\DataStore\etc\ssl directory and that the update date of the agsdatastore.ks file does not change.

--Will

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Tue, 24 Apr 2018 09:31:35 GMT

And are you running this from an admin account from the machine that ADS is installed on?

I'd also confirm that the certificate you are using is added to the machine's trusted root certificate store on the machine where ADS is installed

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Tue, 24 Apr 2018 12:10:13 GMT

Andrew,

I am running the updatesslcertificate using a Windows Domain Account that is a member of the Local Administrators Group on the location machine. I am running the command while logged into the machine via Remote Desktop. This Domain user account is the same account that was originally used to install Portal for ArcGIS, ArcGIS Server, and Data Store on the machine. The machine is running Windows 2016 server with IIS for the webserver software. When I go into the Microsoft Management Console (MMC) Certificate Manager, I see my commercial certificate issued for the machine listed under Certificates (Local Computers) > Personal > Certificates. Under Trusted Root Certification Authorities > Certificates, I see four Root certificates listed for the commercial certificate vendor.

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Tue, 24 Apr 2018 12:12:54 GMT

Wait, are you running a 10.6 Enterprise stack on a 2006 server?

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Tue, 24 Apr 2018 12:14:58 GMT

Sorry, Windows 2016 Server.

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Tue, 24 Apr 2018 13:21:20 GMT

Phew

Okay, if you navigate to the ADS logs (by default, this exists at this path: c:\arcgisdatastore\logs\<machinename>\

There will be two folders, 'datastore' and 'server.'

Can you run the utility again and then open up the recentmost log file and search for the event? This should give a lot more detail than Server Manager.

Also, can you confirm that you have a file named 'agsdatastore.ks' in this directory: C:\Program Files\ArcGIS\DataStore\etc\ssl

Also (sorry for the overload), can you confirm that the account running ADS has full permission to the C:\Program Files\ArcGIS\DataStore folder with the option to inherit permissions enabled?

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Tue, 24 Apr 2018 13:27:17 GMT

If those don't work, please email me at Andrew.Valenski@charlottenc.gov, as the other options to "deep troubleshoot" are probably best kept relatively under the wraps, as they modify some of the "deep" files and exposing that information here will probably do more harm than good in the long run

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Tue, 24 Apr 2018 13:51:34 GMT

1. Yes, the file 'agsdatastore.ks' exists. The file has the Date Modified date of when I originally installed the Data Store software.

2. Permissions. I am currently using a local user account, arcgis, to run the ArcGIS Data Store service. This 'arcgis' user account has Full Control on the C:\Program Files\ArcGIS\DataStore folder and Inheritance is enabled.

3. Error Message. I am not finding the error message "Unable to import certificate" in any of the Data Store log files found under D:\arcgisdatastore\logs\<machine name> . I am only seeing the error message as part of the error message output from running the updatesslcertificate utility from the Command Line.

Re: Unable to replace Data Store SSL Certificate

Anonymous User — Tue, 24 Apr 2018 14:02:53 GMT

Then it's best if you email me at Andrew.Valenski@charlottenc.gov so we can get a bit more "in the weeds." I don't want to post on geonet instructions for, if done incorrectly, modifying some core server components.

When I get your email, I'll pass along the next steps!

Re: Unable to replace Data Store SSL Certificate

TheodoreDean — Mon, 18 Jun 2018 04:34:21 GMT

Has this been resolved ? I think we are facing the same problem with 10.6

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Mon, 18 Jun 2018 12:00:43 GMT

Theodore,

No, the issue has not been resolved yet. Andrew Valenski above offered to provide some additional troubleshooting steps. Due to the black box nature of the Data Store, Esri's tech support solution was for me to completely reinstall all of the components of ArcGIS Enterprise. The parts of ArcGIS Enterprise 10.6 we are currently using are working just fine. I had to put this issue aside for the moment because I had to move on to some other tasks. Likely I will need to revisit this issue again in the very near future.

Re: Unable to replace Data Store SSL Certificate

RDEKAdmin — Thu, 21 Jun 2018 19:51:47 GMT

Hi,

We had this issue as well (ArcGIS Enterprise Builder 10.6) but Esri Support was able to provide the following info:

Here's the known bug: [BUG-000114816 : ArcGIS Data Store 10.6 will fail to update it's SSL certificate if the certificate's privacy key has special characters within it.] This problem occurs for Portal for ArcGIS as well, so I would imagine this also occurs in ArcGIS Data Store.

Re-creating our certificate .pfx file with a password that only contained alphanumeric characters solved the problem.

Note that the server we had issues with was running Windows Server 2016. The certificate (with old password containing alpha-numeric characters) updated without issue on a different server running 2012 R2.

Re: Unable to replace Data Store SSL Certificate

JonathanQuinn — Fri, 22 Jun 2018 17:08:33 GMT

I think there are a couple issues here, the first being that the certificate can't be imported, which may be a bug as RdekMappingRdek Admin‌ has described.

The other is, as the OP initially mentioned, the logs/error message don't indicate the problem. If you ever get back to this, I'd suggest logging another bug that the error message should tell you why the operation failed, not just that it failed.

"Error encountered: Machine 'https://<server name>:2443/arcgis/datastoreadmin' returned an error. 'Unable to import certificate' doesn't tell you much.

Re: Unable to replace Data Store SSL Certificate

FabianMeyer — Mon, 01 Jul 2019 05:41:49 GMT

I know this is an old issue, but it concerns us every three month because we regulary change the SSL certificates of our Enterprise site (Let's encrypt certs). I find out that you can't update the certificate, if you use the same Alias. If you try so, it will return the error message mentioned above. So I change the Alias everytime I update the SSL certificate by adding a counter to the Alias and everything is ok.

Just want to share this workaround-

Re: Unable to replace Data Store SSL Certificate

WilliamRice — Thu, 04 Jul 2019 18:55:49 GMT

Ok. Thanks for sharing what you found out and your work around.

Re: Unable to replace Data Store SSL Certificate

NiekGoorman1 — Wed, 27 May 2020 11:32:42 GMT

Thanks Fabian - this was a very useful bit of knowledge as it's still affecting me at 10.7.1. Changed the password to exclude special characters and used a new alias. Bugs like this really should not be present at all, and certainly not after another major release of the software. How did this get past QA?