HTTPS Certificate SSL Issues ArcGIS Monitor

[Mark_Verlaat]

Hi all,

I just have set up the ArcGIS Monitor 2023.0 on my system. It works quite well. 

I have a problem though with implementing the SSL Certificate which we use with the DNS within the Monitor Admin panel. 

When I save (and force restart) the server, the server hangs, won't start anymore (not the Localhost, not my own Web Context URL, etc.). It starts, but stops almost instantly. 

I want to bypass this to make a rewrite rule (so in this case name.dnsname.nl/arcgis needs to point to name.dnsname.com:30443/arcgis) so that I can bind the certificate to the 443 port (https) of the default server. But that didn't work too (maybe I did something wrong with the rewrite rule). 

Can someone help me with this? Thanks in advance,

[VHolubec]

Hi @Mark_Verlaat,

is the certificate compatible with OpenSSL 3 and TLS 1.2? 

Another solution could be a Rewrite/Reverse proxy rule on the IIS.

Thanks.

[EsriEvan]

Hi Mark

There is an issue with 2023.0 which does not prevent "unaccepted" certificate chains from passing the upload. This will ultimately cause the runtime to fail when the restart occurs. The dev team has fixed this one and will be part of 2023.1 .

In the meantime, the fastest way to recover from that scenario is to navigate into the config store and delete the PFX file living under the SSL directory. After restarting Monitor, it will re-create the self-signed one and recover.

We're also about to publish a quick article how to use IIS to proxy requests to Monitor Server and how to terminate SSL at IIS, which may be helpful in this scenario.

[EsriEvan · Accepted solution]

The article I mentioned above is available here:

Connecting to ArcGIS Monitor 2023 through IIS - Esri Community

[Mark_Verlaat]

Thanks Evan, for this article. It works perfectly. 

[JamesFaron]

Hi Evan,

Where is the config store that you are referring to in your response? 

"the fastest way to recover from that scenario is to navigate into the config store and delete the PFX file living under the SSL directory."

Need some details here in order to try out your proposed solution.

[VHolubec]

Hi @JamesFaron,

the configstore of the Monitor is located in folder under profile of the user running the Monitor: "C:\Users\<user_running_the_Monitor_service>\AppData\Local\ESRI\ArcGISMonitor\config-store-server"

The pfx certificate is then in SSL folder.

Hope it helps.

[JamesFaron]

Thanks Vladimir, I was able to find it after posting, but this will be useful for others as well. 

[VHolubec]

Hello,

I can confirm, that workflow mentioned by @EsriEvan, is pretty neat and the Monitor and its agents are available via 443 port easily then.

[Mark_Verlaat]

Thanks for the replies, I am being swamped at the moment, so I will be testing this coming weeks.