ArcGIS Enterprise Patch Notification: Connect to proxy server failed.

[dstrigl]

Dear community,

we are using the ArcGIS Enterprise Patch Notification tool on several servers, which all connect to the internet via the same proxy server.

Now we have one new server where we get the error "Connection to server failed.", when we try to apply the used proxy server host and port in the settings of the tool:

This only happens on this one server and the interest part is, that connecting to the internet via the same proxy server works on this machine in Python:

Also in the Edge web-browser it works fine, only inside the Patch Notification tool we are not able to connect to the proxy server 😞.

Any ideas?

Regards,

Daniel.

[LeenaAbdulqader]

Hello @dstrigl 

Hope you are doing well.

I have seen this issue before but with a 10.7.1 environment and what we did was to ensure the HTTP proxy configuration has both Listen and Allow specified to the IP address running the Patch Notification utility. Furthermore, the port used by the HTTP proxy must be available and opened in the targeted machine.

Here are some of the solutions you can try:

• Use the Patch Notification tool without connecting to a proxy
• Connect to the Patch Notification tool using a proxy that does not require HTTP authentication
• Manually download patches from https://support.esri.com/en/downloads

Best,

[dstrigl]

Hi @LeenaAbdulqader,

thanks for your fast response to our problem.

> Here are some of the solutions you can try:

    > Use the Patch Notification tool without connecting to a proxy

That's not possible in our company environment.

    > Connect to the Patch Notification tool using a proxy that does not require HTTP authentication

That's the current case. We don't need a authentication when connecting to the proxy.

    > Manually download patches from https://support.esri.com/en/downloads

Ok, that's always possible. But on the other servers we also use the tool in the cmd in combination with a Python script which inform us every week, if there is a security patch available.

What I don't understand is, why it only happens on this server and it works inside the browser, with cURL and Python.

Regards,

Daniel.

[Scott_Tansley]

Check the OS firewall rules on the other machine and compare to this one?  You may need to create an outbound entry?  

Also when you’re using unauthenticated proxies there could be a whitelist (there) of what servers can pass through.  This new server may not have been appended to the list

more likely to be a network than an Esri problem IMHO.  

[dstrigl]

Hi Scott, thanks for your answer!

> more likely to be a network than an Esri problem IMHO

that's also what I thought, but what speaks against is the behaviour that running a cmd with the same user and performing a curl get or requests get in Python with the same proxy settings works fine!

Regards,

Daniel.

[dstrigl · Accepted solution]

I found the problem, it was our fault:

We forgot to import our Root CA certificate under /arcgis/portaladmin/security/sslCertificates.

[ar_tw]

Any idea if this is still the case?

Loading the Root CA into portal wasn't sufficient for me. I had to manually load it into the java environment that the patchnotification tool was using, a bit concerned about whether this is documented and supported.
<ArcGISInstall>\framework\runtime\jre\lib\security\cacerts

(Patchnotification tool unable to connect to proxy ... - Esri Community)

[dstrigl]

Hi @ar_tw,

I will try to summarize my current knowledge and experience on this topic:

The ArcGIS Enterprise Patch Notification tool is available at several places, depending on what you have installed:

• For Portal for ArcGIS at C:\Program Files\ArcGIS\Portal\tools\patchnotification.
• For ArcGIS Server at C:\Program Files\ArcGIS\Server\tools\patchnotification.
• For ArcGIS DataStore at C:\Program Files\ArcGIS\DataStore\tools\patchnotification.

Each of them has its own certificate store in the \framework\runtime\jre\lib\security\cacerts at the corresponding directory.

The normal case is/should be that when adding a certificate (e.g. Root CA) under the Portal Administrator Directory (under /security/sslCertificates) or the ArcGIS Server Administrator Directory (under /machines/<MACHINE>/sslcertificates) it should be also added to this internal cacerts store.

For the cacerts in the ArcGIS DataStore there isn't such a synchronization and you must add all additional needed certificates manually.

This was still the case in our setup so far ... but after one of the last installed patches, our internal cacerts from the Portal for ArcGIS was "resettet" to the default and all manually added certificates so far was missing.

So I also had to add the missing certificates manually in this internal cacerts store to get the Patch Notification tool running.

[PatrickFoppe]

Fantastic information @dstrigl !
Adding a few additional nuggets of information for others out there running into this situation.

For our organization, this used to work just fine... assuming that is because by default it would request the patches URL over HTTP port 80.  And at 10.9, it was updated to request the patches information over HTTPS port 443.  See https://support.esri.com/en-us/bug/the-check-for-arcgis-enterprise-updates-utility-uses-po-bug-00012...

Patches check URL - https://content.esri.com/patch_notification/patches.json

Our organization has an SSL intercept appliance in place to capture all outbound internet traffic and as a result, it presents a private/corporate SSL certificate which is not trusted by default (for HTTPS/443 requests).  We do add this to the back-end portal/server/datastore admin REST API location, but it is not automatically updating the cacerts file that this utility uses.  

For ArcGIS Server, 

To check to see if the cert exists in the keystore, run this from a cmd.exe:

C:\Program Files\ArcGIS\Server\framework\runtime\jre\bin>keytool -list -v -keystore "C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts"

To add the root CA certificate... export it in X.509 format with PEM (base-64 encoding).  Supposedly a DER/Binary encoding would work as well (but we used the base-64 encoding).  

Then, import that by running this in cmd.exe:

C:\Program Files\ArcGIS\Server\framework\runtime\jre\bin>keytool -importcert -file "C:\tmp\myrootcert.cer" -alias PrivateRootCA -keystore "C:\Program Files\ArcGIS\Server\framework\runtime\jre\lib\security\cacerts" 

The keytool will prompt you for the password which is the default for a cacerts file.  see this if you do not know the default password - https://docs.oracle.com/javase/9/tools/keytool.htm

Once we imported the private/corporate root CA, the utility started working.  Thanks everyone!