topic Re: Install Portal without SSL in ArcGIS Enterprise Portal Questions

Install Portal without SSL

JoeHershman — Fri, 04 Mar 2016 12:32:44 GMT

I am installing Portal internal to a domain. Because it is all internal there is no need for SSL.

I am finding it almost (if not completely) impossible to configure Portal without SSL. Within Portal itself on the security page I have unchecked the 'Allow access to the portal through HTTPS only.'

The issue seems to really be with WebAdapter. When I go to register the Portal with Web Adapter I give it the address:

http://mymachine:7080 (instead of 7443). This works for doing the registration, however, when it registers the Portal it still gives it the Url: https://mymachine/arcgis/home. What I want is the Url to be: http://mymachine/arcgis/home.

So no matter what I do it will send me to the SSL port when I try to connect. Which then give a certificate warning

When I install WebAdapter I tell it to use Port 80.

Using version 10.4 of Server, Portal, WebAdapter

Is it possible to get this working with everything on Port 80. I find it really annoying the esri wants me to add a level of security which is not needed and requires I either install a Windows domain Cert Authority (a complete pain), get a public certificate (expensive and requires I use public names inside my domain), or live with cert warnings (which means users call the help desk constantly).

Thanks

-Joe

Re: Install Portal without SSL

JacobBoyle — Fri, 04 Mar 2016 14:56:46 GMT

Portal requires SSL, there is no way around this. The setting you checked only controls the ability for the end user to add data from insecure servers.

The easiest thing to do is to get your IT department to push the certificate from the portal to the users as a trusted certificate.

Deploy Certificates by Using Group Policy from Microsoft.

Re: Install Portal without SSL

JoeHershman — Fri, 04 Mar 2016 17:42:06 GMT

Thanks. I kind of knew it required it, but was hoping for a different answer. This is a much easier solution than what I listed

I did find this site which I thought a little more concise on adding the certificate:

Manage Trusted Root Certificates

I do think that esri should re-evaluate the need for https with portal. For internal only facing sites I think it adds unnecessary complexity

Re: Install Portal without SSL

RandallWilliams — Thu, 10 Mar 2016 21:39:46 GMT

I'd argue the exact opposite. From an information security perspective, each and every website should require HTTPS, regardless of which audience it's facing - particularly those with username and password requirements. Most information security breaches are caused by 'insiders'. It's very easy for someone inside your building to intercept domain usernames and passwords via man in the middle software like a network sniffer (think a tool like Wireshark).

By requiring HTTPS, particularly in the context of passing user login information and tokens, we're helping to protect your assets. We feel so strongly about this stance that at ArcGIS for Server 10.4, the default is to enable both HTTP and HTTPS traffic, while in previous versions we defaulted to HTTP only. As a software vendor, it's our responsibility to do everything we can to help keep your data and information safe.

It’s Time to Encrypt the Entire Internet | WIRED

Re: Install Portal without SSL

PaulDavidson1 — Fri, 11 Mar 2016 02:55:47 GMT

BTW - you should only need to put the domain cert on the servers.

If you do that and are using IIS, then you need to set the SSL setting in portal and server to Ignore client certificates.

Or you could do as Jacob describes and push the domain cert to all your users and then accept client certs.

But I'm not sure what happens when a client has a self signed cert and a domain cert. If it sends the self-signed cert, then they're going to get a 403 error when trying to log into Portal.

I just struggled with that setup on a test portal.

One of my users could connect, then not connect, then connect.

I finally looked at IIS and realized that the issue was he was doing some development work and sometimes had the domain cert installed, then he removed it, etc...

I think it's better to have the client just accept the domain cert from the server, verify it's chain and authenticity and then you're done.

Note that you will get untrusted warnings when you're on the server itself and going to localhost.

localhost knows no domain. I just use the FQDN when working on the server and then it snaps to the domain cert.

Jacob:

Do you know what happens in the case of a self signed and domain cert on a PC? Probably only going to happen with developers.

Re: Install Portal without SSL

PaulDavidson1 — Fri, 11 Mar 2016 02:57:47 GMT

If we set AGS to be http and https, but Portal is https only, can we add unsecured map services from older, existing AGS boxes (10.1) that are http only?

How does Portal handle that? Does the Hosting Server convert the http output to https and feed that to Portal or does Portal basically step out of the picture when it comes to handling services and they're taken care of by the HServer?

hope that makes some sense.

Re: Install Portal without SSL

JacobBoyle — Mon, 14 Mar 2016 19:05:39 GMT

I've never had an issue with both on the same machine, the PC is only going to use the one the site is telling it to use.

Re: Install Portal without SSL

JacobBoyle — Mon, 14 Mar 2016 19:10:17 GMT

I would run it in mixed mode and just map everything to the HTTPS connection if it were me. It would avoid potential issues for your end users that way.

And I agree with Randall Williams 100%, you should be using HTTPS/SSL for everything. It takes very little to setup a domain CA and add it to the trusted servers for Portal or to push a Self-Signed certificate through Windows, for the small amount of inconvenience, it's just not worth the risks.

Re: Install Portal without SSL

JoeHershman — Mon, 14 Mar 2016 19:17:45 GMT

You have had a different experience than me. I found setting up a AD CA to be a total pain in a 2012 environment and never got it working correct.

Re: Install Portal without SSL

PaulDavidson1 — Mon, 14 Mar 2016 21:37:54 GMT

I agree with Randall and Jacob. Maybe things have gotten much simpler since 2012?

But setting up our Domain cert with Portal, etc... seemed very straight forward.

But to clarify, our Cert was given to me by our AD administrator.

I have had some confusing issues with the self-signed cert getting in the way and giving us untrusted cert issues. But I think I have learned to take the domain cert and install it on the servers in Trusted Root before starting the installation of anything Portal related.

I've also found that using the Chef Cookbooks has greatly simplified the Portal creation process.

Re: Install Portal without SSL

JoeHershman — Mon, 14 Mar 2016 22:06:34 GMT

Applying the cert is not the issue. It is setting up the AD CA (Active Directory Certification Authority) server role that I found complicated.

I believe I am in a different implementation situation than you seem to be. As a consultant I am not in control of what an enterprise IT department wants, can, or is willing to do. Usually adding server roles is not something a large IT organization will easily agree to. So if they don't already have their own domain CA it may not be a possible solution. Jacob's initial suggestion I find may be a workable solution in situations were working with a large IT infrastructure is part of the requirement because it can be done without adding server roles. And I agree with Randall Williams in theory. But again, there are situations when one only has so much influence on IT infrastructure and so there needs to be solutions that don't require something like adding a Domain CA.

Re: Install Portal without SSL

PaulDavidson1 — Tue, 15 Mar 2016 01:59:12 GMT

Yep, that's a very different scenario. Our IT department is much more flexible than many organizations I've dealt with over the years. Of course, we're only serving about 700 employees (w/ 40 in IT) so we can be more flexible. I've been in your situation and frankly, it's no fun to be at the mercy of others. Especially when it's a large, ponderous beast. As the manager for our GIS and Maximo IT programs, I get to control our servers. And I can walk a few doors down and talk to with our leads for AD, Systems, Network or even the CIO. That's very different than being at the whims of the ponderous IT group.

It used to be that Portal did not require SSL but only considered it Best Practice. Your point is valid. But I would think just about any IT dept in this day and age already has CA in their systems and would support your efforts for security. But there are always the exceptions.

Best of luck

Re: Install Portal without SSL

PaulDavidson1 — Tue, 15 Mar 2016 03:02:21 GMT

Hi Jacob:

Can you expound on this statement:" just map everything to the HTTPS connection"

Are you saying, we can register an older http: map service with Portal but then just share the https connection that Portal will be serving up?

The part that I'm confused by is that I can Add Item from our older 10.1, http servers and they show up in Portal just fine.

At this point, I have the Hosting Server using HTTPS Only and Portal has Allow access to the Portal through HTTPS only.

I'm confused as to how the older non https server is able to communicate with Portal since it's not speaking Https.

I must have missed something in my reading (or I skipped over it...)

I have other things that I need to learn & understand about Portal (annotation won't import in a zipped file.gdb but will show from the old map service... etc... but I think these are hijacking this thread and belong in their own)

Thanks...

Re: Install Portal without SSL

JacobBoyle — Wed, 16 Mar 2016 13:52:03 GMT

You can enable both https and http for ArcGIS Server: ArcGIS Help 10.1 . Are you planning on making this externally accessible? If not, just setup your 10.1 instance as a http/https, allowing both communication types, and just map your connection in portal to the HTTPS. You don't even need a web adapter to do this, you'll just map to https://server.yourinternaldomain:6443/arcgis.

Steps from 10.1 help:

Log in to the ArcGIS Server Administrator Directory: http://gisserver:6080/arcgis/admin.
Navigate to security > config > update.
For the Protocol parameter, choose the HTTPS Only option then click Update. Your ArcGIS Server site is automatically restarted. In a developer environment, you may also choose to use the HTTP and HTTPS option. With this option, users will be able to access ArcGIS Server through either HTTP or HTTPS.

Re: Install Portal without SSL

PaulDavidson1 — Thu, 17 Mar 2016 23:50:33 GMT

Any idea why I'm able to Add Items in portal from the http server?

Portal is set to https only and our Hosting Server is https only.

The old server is set to http only.

I can use these registered map services in Portal on maps just fine in most cases.

There is one dev 10.4 server running that appears to offer up map services but then I can't put them on a map in Portal

I have not tried to make a web app yet. I saw similar behavior in AGOL.

I could register http map services in AGOL when inside the firewall and place them on a map.

But when I tried to create a web app or look at the maps via VPN, I cold no longer see the rest endpoints.

I believe this is a well known issue with AGOL and one reason the local map widget was created.

I can of course easily set these older servers to "http or https", as referenced above.

But these are in use with mission critical stuff and are fickle.

So I hesitate to change them out.

Have you ever seen any problems from modifying the configuration like that?

And I assume I'd have to install the domain certificate on those services in order for them to respond correctly.

Or will portal feed those servers the certificate and let them follow the chain out and use it.

I do have a test server I'll do it on first but it's just not as heavily loaded...

Thanks