topic Using SSL with JSON input in ArcGIS GeoEvent Server Questions

Using SSL with JSON input

MarkCollins — Fri, 06 Mar 2015 19:11:57 GMT

I'm trying to use SSL with the JSON input and running into some issues. The input fails to poll the data correctly and displays the following message:

Failed to get a response from https://mark-lenovo/WebServices.External.qa/externalapi.svc/getincidents/1C5F19F8-5341-417D-A45F-5DEADC2C077B.

My JSON service is using a self signed cert which I have installed in the Trusted root certificate authority in the windows certificate store. The certificate validates fine when browsing to the rest URL in IE. (Also tells me DNS and the service itself are working correctly)

This the error displayed in my Geoevent error log:

Is there a special certificate authorization list for the JRE that geoevent uses? Does it use the windows certificate store at all? Is SSL event supported on the JSON input?

Thanks,

Mark

Re: Using SSL with JSON input

MarkBramer — Wed, 18 Mar 2015 14:58:32 GMT

Hi Mark,

GeoEvent uses ArcGIS Server's JRE, so I'd think you'd want to add the cert to Server's cacerts located at: C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security.

Have you tried that?

Mark

Re: Using SSL with JSON input

MarkCollins — Wed, 18 Mar 2015 16:19:21 GMT

Mark,

Thanks! This was very helpful in pointing me in the right direction. I've tested it using the jre in this path and it seems to work fine. Here are the complete steps for importing a certificate into the cert store.

Save a copy of the Certificate Authority ssl certificate to the < C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security>. This can be done by accessing one of your web pages via https in a browser and looking at the certificate information. Go to the details tab and click Copy to File. Export it to a DER encoded binary x.509 (.CER).
Run the following command, including the double quotes, in the < C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security> folder to import the Certificate Authority certificate to the cacerts file (in this example, the certificate is called esrica.cer):
“C:\Program Files\ArcGIS\Server\framework\runtime\jre\bin\keytool” -import -trustcacerts -file esrica.cer> -alias esri_ca -keystore cacerts
The password for this cacerts file is 'changeit'. The alias parameter in the command can be anything and must be different for each certificate added to the store.
Restart the GeoEvent processor service for the changes to take effect

-Mark