SSL Certificate Question

[JD1016]

Hello,

We have just completed a new install of ArcGIS Server, Web Adaptor, and Data Store 10.9.1.

All services have been republished through ArcGIS Desktop 10.8.2 and running well.

However, when accessing an application in AGO we are seeing a "Not secure" warning in front of the URL.

ArcGIS Server comes with a configured self-signed certificate that requires swapping out for another obtained, in most cases, by ones IT department.  My IT Manager is working on obtaining the new certificate but does not know where the certificate should be placed.

Can someone offer some guidance on where this new certificate should be loaded so we can eliminate the "Not secure" warning appearing on all our applications?

Thank you in advance.

Jeff

[Scott_Tansley · Accepted solution]

Assuming that you're using the address of the Web Adaptor machine  when referencing those services in AGO, then it's IIS where you install the certificae.  The Web adaptor will trust the self-signed certificate in the AGS.  

Couple of thoughts.  The ArcGIS  Data Store is only usable if you also have an Enterprise Portal and you've configured it as a Base Deployment.  Otherwise it has no value.

I woudl stronly recommend not publishing with ArcGIS Desktop 10.8.2.  10.9.1 is the last of the servers that supports ArcMap based publishing.  From, the Server Manager you can upgrade your services to ArcGIS Pro.  I'd do that now, otherwise your services will fail when you try to upgrade beyond 10.9.1.  ArcGIS Pro really is the only sensible publishing solution at 10.9.x and beyond.

Have fun.

[JD1016]

The documentation, that I read at least, indicated that in order to keep publishing from ArcGIS Desktop you needed to have 10.8.2 in tandem with ArcGIS Server 10.9.1.  They made note that this was indeed the last version that would support publishing from ArcMap.  I made the decision to upgrade to the latest version I could so that I would still have that as a capability.  I realize eventually I will need to move over to ArcGIS Pro for publishing services and I am fine with that transition.  However, nowhere in the documentation, that I had access to anyway, was there a cautionary statement implying that it was unsafe to publish using 10.8.2.  For instance, in Manager, I do see the exclamation under the General tab indicating "This service is currently configured to use the ArcMap service runtime.  Please migrate this service to use the newer ArcGIS Pro service runtime.  Future versions of ArcGIS Enterprise will require services to be migrated to the ArcGIS Pro service runtime". Within this window you can switch it over to ArcGIS Pro.

My question...if I do that...enable the radio button for ArcGIS Pro in Manager...will I still be able to publish from ArcMap or am I now needing to publish my services from ArcGIS Pro?

[Scott_Tansley]

Hey - it's not unsafe to publish from ArcMap.  The issue is that for years people have used ArcMap with whatever version of ArcGIS Server they were using and that was fine.  But when you have a brand implementation of ArcGIS Server, which is the last to respect ArcMap publishing, it is considered best practice to start using that new environment with the newer technology of ArcGIS Pro.  Each client that I have worked with since 10.7.1, I've made it clear to them that to minimise migration activities, and to simplify the road ahead, they would be best to adopt Pro for all publishing activities and not use ArcMap. 

This may not be in the formal documentation, but it has been repeatedly discussed in conferences, webinars and blogs.  I'm just trying to prevent you publishing too much stuff with ArcMap, when it's end of life and will not be supported after the ArcGIS Server version you are using.

To aid understanding, there are two sets of software libraries under the hood.  One reads MXDs (MSDs actually) and the other understands mapx documents.  After 10.9.1 the older set of software libraries will be removed.  If you have not upgraded to mapx documents, then an over the top upgrade will not lead to the failure of the service you've published, because the code will not be there to supprort them.

Because the software libraries are 'so' different, then no, if you press the button to use the ArcGIS Pro runtime, then you cannot make changes from ArcMap.  Pro should be the only desktop publishing tool at this point in the game.  

[JD1016]

Well, perhaps using the word "unsafe" is not the best vernacular.  However, that was the word that came to mind when I saw a large orange exclamation mark associated with every single one of my services.  While it's great that discussions of this have been going on for quite some time, it really is imperative that the documentation cover reality and not be a complete shock and surprise to us the end users.

I do appreciate you cautioning me on publishing too much in ArcMap.  There is already quite a lot to convert on the horizon but I don't anticipate too many additional "new" services being created going forwards.  Famous last words I'm sure.

My thought was to use this time between now and when 10.9.1 is approaching mature support/retired (December 2025/November 2027 respectively) to begin the very transition to ArcGIS Pro publishing you are speaking of in your response.  We are currently using Pro, just not for publishing as of yet.  Is there a certain comfortability issue with using ArcMap?  Absolutely.  Is change a little unsettling? Again, absolutely.  That doesn't mean we don't have a plan for change, but when surprises of this nature come along things can get a little rocky.  I'm assuming you can understand and relate to that scenario.

That being said, I still have to ask...and you may have implied an answer but I'm not sure...putting future considerations aside and realizing that I will be converting to ArcGIS Pro as we move along...is there going to be any problem or issues I should be aware of if I continue to publish using ArcMap with the current configuration?  Keeping in mind when I I say "publish" most of my publishing is overwriting existing services in favor of updates or publishing another hosted layer.

[Scott_Tansley]

The only issue is if you upgrade to 11.x without upgrading to the Pro runtime first. 

[JD1016]

Understood.