topic Re: Installing SSL Certificate in ArcGIS Enterprise Questions

Installing SSL Certificate

NathanHeickLACSD — Thu, 08 Feb 2024 19:44:39 GMT

When you install an SSL certificate in ArcGIS Server, Portal, or the Data Store, should you delete the self-signed certificate when you are done?

Re: Installing SSL Certificate

MarceloMarques — Thu, 08 Feb 2024 20:12:16 GMT

No, you shall not delete the self-signed certificate.

Re: Installing SSL Certificate

MingLee — Fri, 09 Feb 2024 09:19:03 GMT

No!

Don't delete it.

Re: Installing SSL Certificate

YuvarajS — Fri, 09 Feb 2024 09:59:33 GMT

Don't Delete

Re: Installing SSL Certificate

GraceSmith99 — Mon, 19 Feb 2024 07:10:52 GMT

Yes, it is recommended to delete the self-signed certificate after installing an SSL certificate in ArcGIS Server, Portal, or the Data Store. The self-signed certificate is typically used for initial setup or testing purposes. Once a valid SSL certificate is installed, it enhances security and authenticity. Deleting the self-signed certificate helps ensure that the system relies on the newly installed, trusted certificate for secure communication.

Re: Installing SSL Certificate

JoshuaBixby — Mon, 19 Feb 2024 16:32:05 GMT

@GraceSmith99, seeing the consensus is not to delete it, can you provide references to documentation that recommend deleting it?

Re: Installing SSL Certificate

CharmiPatel21 — Fri, 08 Mar 2024 07:37:19 GMT

Yes, it's generally a good practice to remove the self-signed certificate after installing a trusted SSL certificate in ArcGIS Server, Portal, or the Data Store. This helps ensure that the system uses the newly installed, trusted certificate for secure communications. Removing the self-signed certificate can prevent potential confusion and ensures that the system relies exclusively on the custom SSL certificate for secure connections. Always make sure to back up any certificates before removal in case they are needed for future reference or troubleshooting.

Re: Installing SSL Certificate

JoshuaBixby — Fri, 08 Mar 2024 14:42:32 GMT

@CharmiPatel21, welcome to Esri Community. Esri Community is a great resource for Esri users to learn about ArcGIS products, and what helps users learn is providing documentation or references to documentation when talking about good, bad, or any time of practices.

The certificate that ArcGIS Server, Portal, etc... use is explicitly specified as a machine-level setting (webServerCertificateAlias) in Edit Machine—ArcGIS REST APIs | ArcGIS Developers. Whether there is 1 certificate, 2 certificates, or 10 certificates on the machine; it is only the one specified in the property that is used by ArcGIS so leaving the original self-signed certificate does not create any risk of confusion for the software.

Re: Installing SSL Certificate

NathanHeickLACSD — Fri, 08 Mar 2024 16:59:40 GMT

I left the SSL certificate in place with no problem. What I'm interested in knowing is if the server will use the self-signed certificate if the CA certificate expires.

Re: Installing SSL Certificate

JoshuaBixby — Fri, 08 Mar 2024 18:00:49 GMT

I can't say I have seen documentation specifically addressing that question, but I have never seen ArcGIS Server change a certificate on its own, i.e., I have always seen it stick with the expired certificate if that is the certificate it is told to use.

Re: Installing SSL Certificate

danielwill — Tue, 09 Apr 2024 09:32:37 GMT

Even if you have installed a valid SSL certificate, you should not delete the self-signed certificate from ArcGIS Server, Portal, or Data Store. Here's why.

Fallback Option:- The self-signed certificate is used as a backup in case your genuine certificate fails. It provides basic functionality within your ArcGIS environment for troubleshooting purposes.

Testing:- The self-signed certificate might be useful for testing your ArcGIS installation to ensure its functionality before setting a trusted certificate.

While you do not have to delete the self-signed certificate, you should ensure that it is not the active certificate used for secure connections. Here's what you should do instead.

Configure Valid Certificate:- To Configure ArcGIS Server, Portal, or the Data Store to utilize this certificate for safe connection after getting a valid SSL certificate from a reliable Certificate Authority

Disable Self-Signed:- To avoid unintentional use, you can disable the self-signed certificate in certain ArcGIS versions. This isn't necessarily required, though, and it might not be included in every edition.