Problems adding external WMS reference (Spain Catastro) in Portal

[RafaEsteveMartínez]

Hi.

We are trying to add some external references to public WMS services inside our portal (using New Item | URL).

When adding one of them, from the Spanish Catastro (https://ovc.catastro.meh.es/Cartografia/WMS/ServidorWMS.aspx), Portal shows an error message saying "error connecting to service". The log shows a couple of Severe error messages, saying:

• Invalid SSL certificate found. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
• URL 'https://ovc.catastro.meh.es/Cartografia/WMS/ServidorWMS.aspx?SERVICE=WMS&REQUEST=GetCapabilities' is not accessible: Error. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.

We have no problems with other WMS services, and we can add the Catastro WMS service as a service connection in an ArcGIS PRO project.

According to Fiddler, the web request that is failing (with a "500 - Internal Server Error" code) is this one that gets launched by the item adding process:

https://our.server/portal/sharing/proxy?https://ovc.catastro.meh.es/Cartografia/WMS/ServidorWMS.aspx?SERVICE=WMS&REQUEST=GetCapabilities 

Our DevOps people has tried the solution listed here (different problem, similar symptoms), but the error is still there.

Is there some way of checking that the certificates are working with Portal as they should?

Considering we are not sure the certificates solution is attacking the source of the problem, can we try some other thing in order to connect to this service?

We are using ArcGIS Enterprise 10.9.1 (build 28388).

Thanks

[JeffSmith · Accepted solution]

Yes, I think the issue you are seeing is related to the certificate not being trusted.  An easy way to check that is to use the checkUrl endpoint in the Portal sharing api (assuming HTML access is enabled).
https://our.server/portal/sharing/rest/portals/checkUrl

This will tell you if the certificate for that url is trusted or not.  Assuming it is not trusted, you may need to import both the root and intermediate certificate for the CA that signed the certificate.  Portal will need to restart after importing these certificates.  Once restarted, use the checkUrl endpoint again to confirm it is trusted.

To get copies of those root and intermediate certificates, the easiest way is to use Chrome or Edge to view the details of the certificate and you can export each one from there.

[RafaEsteveMartínez]

Solved: the problem was that we didn't import the intermediate certificate. Once done, everything worked like a charm!!

Thanks