topic Re: ArcGIS Server Manager page not accessible after https/SSL configuration in ArcGIS Enterprise Questions

ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Thu, 26 Dec 2013 11:25:26 GMT

i was in the middle of configuring ArcGIS Server 10.1 in the rest ADMIN where i was enabling HTTPS only instead of HTTP then imported an SSL certificate when suddenly the connection with the ADMIN page got lost and i could not connect again. i get a message the page could not be displayed or found. i was using https://servername:6443/ArcGIS/manager and https://serverName:6443/arcgis/admin/security/config but after i lost the connection, i am not able to open the ArcGIS server pages. in addition, i could not connect using http with port 6080. Moreover, i could not connect to ArcGIS server from ArcCatalog as its complaining about a BAD address.

i forgot to mention that i checked the service for ArcGIS server and confirmed it is running. i even restarted the service several times and restarted the host server with no luck.

we are running ArcGIS server 10.1 on Windows Sever 2008 R2 environment NO web adapter configured

how to re-establish the connection to ArcGIS Server manager or rest pages ?

is there a way to reset the configuration from HTTPS only to HTTPs and HTTP ?

is there a way to default back these security changes in ArcGIS Server ?

appreciate any input

thanks

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Thu, 26 Dec 2013 11:27:20 GMT

i forgot to mention that i checked the service for ArcGIS server and confirmed it is running. i even restarted the service several times and restarted the host server with no luck.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

RandallWilliams — Fri, 27 Dec 2013 15:36:19 GMT

Esri support services should be able to help you get your site back to allowing a connection on 6080 (http). It's best to test with both http and https enabled before switching to https only to verify that the SSL certificate will work with ArcGIS Server.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

RichardWatson — Fri, 27 Dec 2013 17:43:29 GMT

I would search through all the ArcGIS Server configuration files for the one which stores this setting and try updating that.

Another alternative is to clean ArcGIS Server off the machine and reinstall it. By clean, I mean that you uninstall it and manually remove any files related to it from the file system. Just uninstalling the software is typically insufficient.

If you have backups then another alternative is to roll the server back to a point before you made these changes.

Of course, as pointed out by Randall, support services is another option for you.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

WilliamCraft — Fri, 27 Dec 2013 20:35:59 GMT

how to re-establish the connection to ArcGIS Server manager or rest pages ?

is there a way to reset the configuration from HTTPS only to HTTPs and HTTP ?

is there a way to default back these security changes in ArcGIS Server ?

I believe that the HTTP Only, HTTP and HTTPS, and HTTPS Only settings for the protocol under Security --> Config in AGS Manager pertain to the web adaptor, so altering the value as you mentioned should not cause the issue especially since you said that no web adaptor had been configured and your URL requests use a port number. Based on the info you provided, I would suspect the importing of another security certificate to be the culprit for the time being. It sounds like SSL was working just fine for you initially. A few things to try and/or consider first...

Did you import a CA-signed certificate to replace the default self-signed certificate in AGS? If so, did you use the importRootorImmediate option or the importExistingServerCertificate option? If it's a CA-signed certificate, take a look at the certification path properties for that certificate and verify that all of the certs in the path (i.e., the root cert, any intermediary certs, and the cert itself) exist in the Trusted Root Certification Authority on the AGS machine. You'll know if all of them are trusted when you view the certification path properties depending on whether or not a red X appears next to any of them.

Alternatively, if you need to "clear out" any changes you made regarding the security certificates to get things back to normal per se, you MIGHT be able to try the following:
1. On the server, go to C:\arcgisserver\config-store\machines and open the <servername>.json file (assumes AGS was installed at C:\arcgisserver) using Notepad or Notepad++. Make a backup of the file in the same directory, first.
2. In that file, find the section with "webServerCertificateAlias" and change the value after the colon to be exactly selfsignedcertificate surrounded by double quotes just as you see with the current value. If it's already set to this value, then more than likely you did not try to import a CA-signed certificate into AGS and this most likely isn't your issue.
3. Save the file and then re-start the ArcGIS for Server Windows service.
4. After about a minute following restart of the service in #3 above, try re-requesting the URLs you mentioned to see if the behavior is different. If so, then refer back to the second paragraph of my reply and make sure that, if using a CA-signed certificate, you follow the proper steps to ensure it is trusted on the AGS machine along with any of its intermediary and root certs. If not, then revert back to the backup file created in #1 above and restart the AGS service again since this probably isn't the correct issue and associated fix.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

divyamgulati1 — Sat, 28 Dec 2013 00:50:02 GMT

In the config store under the security folder, you have to make changes in the json file. Stop the Arcgis server service from the windows services panel and set the ssl enabled= false in this json configuration file..

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:14:24 GMT

Esri support services should be able to help you get your site back to allowing a connection on 6080 (http). It's best to test with both http and https enabled before switching to https only to verify that the SSL certificate will work with ArcGIS Server.

Thanks,

i opened a channel with local ESRI distributer and hopefully they can help in this regard

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:16:35 GMT

I would search through all the ArcGIS Server configuration files for the one which stores this setting and try updating that.

Another alternative is to clean ArcGIS Server off the machine and reinstall it. By clean, I mean that you uninstall it and manually remove any files related to it from the file system. Just uninstalling the software is typically insufficient.

If you have backups then another alternative is to roll the server back to a point before you made these changes.

Of course, as pointed out by Randall, support services is another option for you.

our local ESRI distributer recommended a re-installation .. i am somewhat hesitant to go through that as i would like to know first what caused and how to avoid this in the future .. its a good idea to seach for SSL saved configuration .. i'm planning to do that shortly

unfortunately, we don't have ArcGIS Server backups .. otherwise, it would have been an easy recovery. i am planning to do that backup in the future. thanks

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:24:42 GMT

I believe that the HTTP Only, HTTP and HTTPS, and HTTPS Only settings for the protocol under Security --> Config in AGS Manager pertain to the web adaptor, so altering the value as you mentioned should not cause the issue especially since you said that no web adaptor had been configured and your URL requests use a port number. Based on the info you provided, I would suspect the importing of another security certificate to be the culprit for the time being. It sounds like SSL was working just fine for you initially. A few things to try and/or consider first...

Did you import a CA-signed certificate to replace the default self-signed certificate in AGS? If so, did you use the importRootorImmediate option or the importExistingServerCertificate option? If it's a CA-signed certificate, take a look at the certification path properties for that certificate and verify that all of the certs in the path (i.e., the root cert, any intermediary certs, and the cert itself) exist in the Trusted Root Certification Authority on the AGS machine. You'll know if all of them are trusted when you view the certification path properties depending on whether or not a red X appears next to any of them.

Alternatively, if you need to "clear out" any changes you made regarding the security certificates to get things back to normal per se, you MIGHT be able to try the following:
1. On the server, go to C:\arcgisserver\config-store\machines and open the <servername>.json file (assumes AGS was installed at C:\arcgisserver) using Notepad or Notepad++. Make a backup of the file in the same directory, first.
2. In that file, find the section with "webServerCertificateAlias" and change the value after the colon to be exactly selfsignedcertificate surrounded by double quotes just as you see with the current value. If it's already set to this value, then more than likely you did not try to import a CA-signed certificate into AGS and this most likely isn't your issue.
3. Save the file and then re-start the ArcGIS for Server Windows service.
4. After about a minute following restart of the service in #3 above, try re-requesting the URLs you mentioned to see if the behavior is different. If so, then refer back to the second paragraph of my reply and make sure that, if using a CA-signed certificate, you follow the proper steps to ensure it is trusted on the AGS machine along with any of its intermediary and root certs. If not, then revert back to the backup file created in #1 above and restart the AGS service again since this probably isn't the correct issue and associated fix.

i appreciate your effort

you are right, as i am trying to remember what could have been the cause, yes everything collapsed after i imported a CA-Signed certificate. i did not replace the existing sefl-signed default certificate. i just imported an additional one that was previousely generated and signed by our coportate CA authority. i have been reading about this issue and found out post saying you cannot import a certificate created outside ArcGIS server in 10.1 and this might be different for 10.2 .. our ultimate goal is to have all our services secured and delivered to our proponents in in HTTPS.

i'll follow your steps and hopefully i can get the instance up and running again

thanks again

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:25:54 GMT

In the config store under the security folder, you have to make changes in the json file. Stop the Arcgis server service from the windows services panel and set the ssl enabled= false in this json configuration file..

Hey there,

thanks for the tip. i'll try to do that and hope it works

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:42:35 GMT

Hey there,

thanks for the tip. i'll try to do that and hope it works

Hey there,

This suggested fix did not work.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Sun, 29 Dec 2013 04:55:40 GMT

I believe that the HTTP Only, HTTP and HTTPS, and HTTPS Only settings for the protocol under Security --> Config in AGS Manager pertain to the web adaptor, so altering the value as you mentioned should not cause the issue especially since you said that no web adaptor had been configured and your URL requests use a port number. Based on the info you provided, I would suspect the importing of another security certificate to be the culprit for the time being. It sounds like SSL was working just fine for you initially. A few things to try and/or consider first...

Did you import a CA-signed certificate to replace the default self-signed certificate in AGS? If so, did you use the importRootorImmediate option or the importExistingServerCertificate option? If it's a CA-signed certificate, take a look at the certification path properties for that certificate and verify that all of the certs in the path (i.e., the root cert, any intermediary certs, and the cert itself) exist in the Trusted Root Certification Authority on the AGS machine. You'll know if all of them are trusted when you view the certification path properties depending on whether or not a red X appears next to any of them.

Alternatively, if you need to "clear out" any changes you made regarding the security certificates to get things back to normal per se, you MIGHT be able to try the following:
1. On the server, go to C:\arcgisserver\config-store\machines and open the <servername>.json file (assumes AGS was installed at C:\arcgisserver) using Notepad or Notepad++. Make a backup of the file in the same directory, first.
2. In that file, find the section with "webServerCertificateAlias" and change the value after the colon to be exactly selfsignedcertificate surrounded by double quotes just as you see with the current value. If it's already set to this value, then more than likely you did not try to import a CA-signed certificate into AGS and this most likely isn't your issue.
3. Save the file and then re-start the ArcGIS for Server Windows service.
4. After about a minute following restart of the service in #3 above, try re-requesting the URLs you mentioned to see if the behavior is different. If so, then refer back to the second paragraph of my reply and make sure that, if using a CA-signed certificate, you follow the proper steps to ensure it is trusted on the AGS machine along with any of its intermediary and root certs. If not, then revert back to the backup file created in #1 above and restart the AGS service again since this probably isn't the correct issue and associated fix.

hey there,

i followed the steps but no luck. i have a CA-Signed certificate generated outside of AGS. there seem to be something fishy in this area but i can't put my fingers on it.

i'll have to re-install maintaining the current folders as they have all of our published services and hopefully it would work

thanks

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

WilliamCraft — Sun, 29 Dec 2013 12:11:23 GMT

Did you by chance apply SP1 to your 10.1 installation recently? Before performing the re-installation, please check the Windows Firewall on your server and client to see if it might be running along with any other anti-virus software that could be blocking the 6080 and 6443 ports. You may need to temporarily disable them to see if this does the trick; if so, you can create a focused rule for the ports you need. Also, what happens when you log directly into the server and attempt to request the same URLs from a browser locally?

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

EyadHammad — Mon, 30 Dec 2013 02:41:32 GMT

Did you by chance apply SP1 to your 10.1 installation recently? Before performing the re-installation, please check the Windows Firewall on your server and client to see if it might be running along with any other anti-virus software that could be blocking the 6080 and 6443 ports. You may need to temporarily disable them to see if this does the trick; if so, you can create a focused rule for the ports you need. Also, what happens when you log directly into the server and attempt to request the same URLs from a browser locally?

Thanks for your reply

we did that. In addition, we added the programs in inbound exceptions for Windows firewall for

B. ArcGISServer.exe    <Install>\ArcGIS\Server\framework\etc\service\bin\ArcGISServer.exe
C. ArcSOC.exe                <Install>\ArcGIS\Server\bin\ArcSOC.exe
D. javaw.exe              <Install>\ArcGIS\Server\framework\runtime\jre\bin\javaw.exe
E. rmid.exe                 <Install>\ArcGIS\Server\framework\runtime\jre\bin\rmid.exe

however, we were unable to get AGS back

our last resort is to cleanup all and do a new installation, and publish again all of our services.

regards,

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

StephanieSnider — Tue, 07 Jan 2014 22:23:29 GMT

I've had this happen before after importing a trusted certificate - that ArcGIS Server didn't like. crafty762 suggestion is close to what I did...but to a different file.

1. Navigate to the ArcGIS Server Tomcat directory on the server. Depending on where you install ArcGIS Server, it will be something like ....ArcGIS\Server\framework\runtime\tomcat\conf
2. Open the server.xml and scroll down to the bottom.
3. On the last line of code, you will see a keyAlias =�?�name of the certificate�?�. Since this one isn�??t working, change the alias back the original ESRI selfsigned certificate (SelfSignedCertificate). Save file.
4. Stop and start the ArcGIS Server service.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

BrendanWalashek — Sat, 29 Mar 2014 15:55:50 GMT

I've had this happen before after importing a trusted certificate - that ArcGIS Server didn't like. crafty762 suggestion is close to what I did...but to a different file.

1. Navigate to the ArcGIS Server Tomcat directory on the server. Depending on where you install ArcGIS Server, it will be something like ....ArcGIS\Server\framework\runtime\tomcat\conf
2. Open the server.xml and scroll down to the bottom.
3. On the last line of code, you will see a keyAlias =�?�name of the certificate�?�. Since this one isn�??t working, change the alias back the original ESRI selfsigned certificate (SelfSignedCertificate). Save file.
4. Stop and start the ArcGIS Server service.

On step 3, what is the actual name I should put in there for the ESRI selfsigned certificate? Where would I find that name? My server is crippled until I can fix this....
Thank you so much!

As a horrible alternative, if I were to uninstall ArcGIS Server 10.2 and reinstall, will I lose all my services? Is there any way of saving them without having access to ArcGIS Server Manager?

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

StephanieSnider — Mon, 31 Mar 2014 14:20:01 GMT

brendwal,
Update the code to keyAlias =�?�SelfSignedCertificate�?� which is the default certificate that comes with ArcGIS Server. Remember to stop and start the ArcGIS Server service after saving changes to this file. You don't have to lose services if you reinstall ArcGIS Server. Before you uninstall, copy the ..\arcgisserver config-store and directories folders. You can import them back in during the install process or install without them and then copy them over manually.

Re: ArcGIS Server Manager page not accessible after https/SSL configuration

SantiagoGonzalez_Arriola — Mon, 17 Oct 2016 22:11:05 GMT

Just wanted to confirm that Stephanie Snider's workaround works. I followed crafty762's advise (changing .../config-store/machine_name.json) and that didn't work. Changing the server.xml under Tomcat conf did the trick!

Steph you are a life saver, I can't thank you enough! Reinstalling and re-publishing services can be a huge nightmare for many. There's always hope!

This worked for me on AGS 10.4 running on Ubuntu Server on AWS.