MapProxy WMS works in ArcMap and ArcGIS Pro using HTTP, but ArcGIS Online fails. Can it work?

[DavidBrooks5]

I have a WMS that I'm serving on an AWS instance that works in ArcMap and ArcGIS Pro, but when I try and add to an AGOL web map, it successfully adds to the map with user credentials, but AGOL sends encrypted SSL get requests to the server (which is running over HTTP :8080) and fails to return tiles back to AGOL. 

What's interesting is that the initial get capabilities request goes over in plain text (hence why my wms can be populated and added to the map with service credentials in the bottom right corner), but then AGOL switches to making HTTPS requests for the tile (it seems). Running developer tools in chrome yields the following error message:

Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR

I can provide a link to the WMS if anyone would like to test this themselves. The coordinate system is WMAS (3857) and I've tried adding as a layer, and as a basemap. I've also tried specifying parameters in the wms wizard.

For anyone with MapProxy experience, the CMD console returns the following during the SSL tile requests from AGOL:

[error] 195.143.10.203 - - [10/Mar/2020 08:16:00] code 400, message Bad HTTP/0.9 request type ('\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03)\x85\xdb{\x99\xd1.i\x13\x96\xc2Es\x82o\x1c[8F\xef/*\\\x1amM\x04\x98g\xa61\x1d')
[info] 195.143.10.203 - - [10/Mar/2020 08:16:00] " ⁿ )à█{Ö╤.i û┬Eséo [8F∩/*\ mM ÿgª1 ± ¡í?Å▀Pù Aé:¡┬?σ8IdÖa ≡ uX╩σ;▀É "JJ └+└/└,└0╠⌐╠¿└ └ £ ¥ / 5 " 400 -
[error] 195.143.10.203 - - [10/Mar/2020 08:16:00] code 400, message Bad request syntax ('\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03\x02\x14\x02Y\xdc`\xdaC\xa6')
[info] 195.143.10.203 - - [10/Mar/2020 08:16:00] " ⁿ Y▄`┌Cª" 400 -
[error] 195.143.10.203 - - [10/Mar/2020 08:17:25] code 400, message Bad request syntax ('\x16\x03\x01\x02\x00\x01\x00\x01\xfc\x03\x03\x18\xfa\x11RB')
[info] 195.143.10.203 - - [10/Mar/2020 08:17:25] " ⁿ · RB" 400 -

But the following during tile requests from ArcMap:

[info] 195.143.10.203 - - [10/Mar/2020 08:21:32] "GET /service?SERVICE=WMS&VERSION=1.3.0&REQUEST=GetMap&CRS=EPSG:3857&BBOX=-8670903.73129359260201454,-10566598.1958502009510994,8225625.76812049094587564,10566598.1958502046763897&WIDTH=674&HEIGHT=843&LAYERS=BING_Hybrid&STYLES=&EXCEPTIONS=XML&FORMAT=image/png&BGCOLOR=0xFEFFFF&TRANSPARENT=TRUE& HTTP/1.1" 200 -

Im wandering if AGOL forces HTTPS, due to it's security policies. I'll need to change the MapProxy configuration to serve over HTTPS if that's required for troubleshooting.

[JacobWatson1]

I'm afraid I cant help out with anything super specific or technical but as a general troubleshooting step, have you looked at your organization security settings (If you are apart of one).

Under the security setting for organizations in ArcGIS Online, there is a selection that only allows HTTPS. I found I had to deselect this options when attempting to add data from a non HTTPS server to an Online Map.

Here is a picture of the setting I am talking about.

Hope this helps!

- Jacob

[DavidBrooks5]

Hi Jacob,

Thanks for the tip, but because my organisation has been working in HTTPS since it's conception, I don't have the option to accept HTTP sources. Not a problem, will just have to look into hiding my MapProxy behind a HTTPS reverse proxy.

[ChrisWhitmore]

David Brooks‌ if you check out the capabilities response, do you see https urls defined? The map viewer should make requests with the protocol defined in the capabilities response. Overall though, supporting / using https is recommended..browsers (and Esri) will be pushing things to all https more and more.

Cheers,

Chris

[DavidBrooks5]

Yes, it's making a https capabilities request even though i initiate the call as a http request

[ChrisWhitmore]

Sorry when I posted my question, I didn't see the response you'd already posted to previous questions about your agol organization's https setting (and that you have HTTPS enabled).

 In that case, yes the map viewer will make HTTPS requests for the capabilities xml. As you also mentioned, you should proceed with setting up HTTPS on the WMS server