topic Re: ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL in Implementing ArcGIS Questions

ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL

RenatoTeixeira1 — Sat, 25 Jul 2020 01:11:24 GMT

Deploying Enterprise 10.7.1, I want to replace self-sign ssl from Datastore with my own CA Certificate, when I run updatesslcertificate in with power shell ow cmd(as admin) with a command:

.\updatesslcertificate.bat my.domain.com.pfx "mypassword" "myalias"

updatesslcertificate.bat my.domain.com.pfx "mypassword" "myalias"

output return a error:

Error encountered: The data store may not have been initialized.

adicional info:

I'm using this help:

Replace ArcGIS Data Store SSL certificate—ArcGIS Data Store (Windows) Installation Guide | Documentation for ArcGIS Ent…

when I open https://localhost:2443/arcgis/datastore/ , open page ok to create a datastore, and I'm trying to replace this SSL before create a DataStore.

I'm running command inside installation directory: C:\Programs and Files\ArcGIS\DataStore\Tools

Windows Server 2016 on azure

Enterprise 10.7.1

ArcGIS Datatore windows service running

ArcGIS installation directory: C:\Programs and Files\ArcGIS\DataStore\

tx advance

enterprise 10.7.1‌ datastore commands‌ datatore‌ ssl‌

Re: ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL

JeffDeWeese — Tue, 28 Jul 2020 21:06:10 GMT

Hello. Several us on the Architecture & Security team have looked at this and believe this may be a mis-configuration of some sort and the recommendation is to contact Esri Technical Support for further guidance.

Re: ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL

ChristopherPawlyszyn — Fri, 07 Aug 2020 15:18:33 GMT

Hi RENATO TEIXEIRA,

Have you tried importing the certificate following the configuration of the ArcGIS Data Store with the associated Server site? We have a defect in the works regarding the logic of the updatesslcertificate tool, but that is the established workaround for the time-being. Hope that helps! Otherwise as Jeff suggested a support case may be helpful to pursue some additional troubleshooting angles.

Re: ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL

RenatoTeixeira1 — Fri, 07 Aug 2020 18:49:09 GMT

I found out that the tool only works after I have joined ArcGIS Server, so I decided to give up on this certificate and use Self-Signed, and my certificate is a wildcard issued by globalsign and ArcGIS is not making it secure even by installing root on the server. I really can't understand why, since the same certificate is used on the webserver for the webadaptor and it works.

Re: ArcGIS DataStore - updatesslcertificate utility don't work to replace SSL

ChristopherPawlyszyn — Thu, 13 Aug 2020 14:14:16 GMT

The certificate would have to include either a CN or SAN entry that would cover the URL you're using to access the Data Store URL. Typically when we run into issues with customers using their Web Adaptor SSL certificate on all endpoints for ArcGIS Enterprise's internal web servers, the Web Adaptor certificate covers the public-facing URLs or DNS aliases without including the internal machine FQDNs. We have logged a documentation defect internally to fix the misinformation on the Data Store configuration page in terms of importing the certificate prior to the initial configuration.