Getting Error when trying to set up Reports from the Survey123 Website (with our ArcGIS Enterprise Environment)

[GregDunnigan]

Asking this here in case anyone has a quick answer...have a ticket into ESRI Support as well.

First, this had been working previously. Last successful report generation was 5/26.

When trying to run a report from the Survey123 Website, we are are getting the attached error regarding:

'SSL routines:final_renegotiate:unsafe legacy renegotiation disabled'

We get this error when trying to run a report, and when trying to add a new Report Doc Template file. Full screenshot of error message in attached picture.

[ZacharySutherby]

Hello @GregDunnigan, 

If you enter your Portal URL into https://www.ssllabs.com/ssltest/analyze.html (check on the box "Do not show the results on the boards") and run the test you will likely see that Secure Renegotiation may not be supported. If this is the case when the ArcGIS Survey123 Report API is trying to reach out to your ArcGIS Enterprise organization since Secure Renegotiation is not supported the Survey123 Report API is not trusting the connection. 

With our 3.18 ArcGIS Survey123 release that went live earlier this week we had updated some of the node libraries used in the Report API and this is resulting in the more strict security standards. 

We are working on our communication and path forward with this requirement. 

[ChrisBeaudette]

Thanks Zach.

I work with Greg and we're attempting to remediate this issue.

Can you advise on what needs to happen on our end in order to support secure renegotiation? If it helps our portal URLs are hosted in F5 endpoints.

Thanks,

Chris

[ChrisBeaudette]

Also this is what the SSLLabs analysis tool reports (which seems to indicate that secure renegotiation is supported?  But it also reported an error immediately before so not sure if this is conclusive):

[ZacharySutherby]

Hello @ChrisBeaudette, 

Thank you for confirming! That is perplexing based on the error received that points to the secure renegotiation being the issue. Would you be able to try generating a report from https://survey123dev.arcgis.com and pass along the jobID for the request to the Support case you have open. We have found the Support case you have open and are in communication with the folks in Tech Support on the issue. 

To access the jobId you will need to capture the web traffic when you select the Generate button in the Report pane. You will see a submitJob request and in the Response to that request you will see a jobId. With this jobId we can check out internal logs to see if there is additional information as to why the error is being returned.  

[ChrisBeaudette]

Hi Zach.

We're not getting a jobID in the response -- we only get the error that is being reported to the UI:

{
    "error": {
        "message": "request to https://<PORTAL WEB ADAPTOR ROUTE>/sharing/rest/portals/self?f=json&token=BIG_LONG_TOKEN failed, reason: write EPROTO 68A17530C87F0000:error:0A000152:SSL routines:final_renegotiate:unsafe legacy renegotiation disabled:ssl/statem/extensions.c:893:\n",
        "code": "EPROTO"
    },
    "success": false
}

I'll provide additional information in the support ticket that will enable you to reproduce the issue against our portal. Let's continue the conversation via the support channel.

Thanks,

Chris

[ChrisBeaudette]

Hey Zach.

We have not had any movement on this issue from tech support since June 16.  Are you working with them on this by any chance?  Could we have someone review and update the support ticket?

Thanks,

Chris

[ZacharySutherby]

Hello @ChrisBeaudette, 

We are in contact with Support and have passed troubleshooting next steps to the analyst.

Thank you, 

Zach

[Alison_Gou_]

Hi @ChrisBeaudette , do you mind sharing your ArcGIS Enterprise version to help investigating? Thanks.

[ChrisBeaudette]

This is happening in our Production system which v10.9.1 and our UAT system which is v11.1.