SSL Configuration Options for Root, Intermediate, and Full Cert Chain

[J-J-E]

Hello,

I am wondering how to appropriately deploy a enterprise primary single machine base deployment with the full valid ssl chain. I'm trying to import the root cert, the intermediate cert, and the valid .pfx cert (including the full cert chain). I don't see options to import them all, and without all three present I am experiencing some issues with the internal communication between the Server and Portal components. Ive included links to the two help articles I referenced leading me to manually importing the three certs and selecting the full chain when importing the signed pfx (this solved my issue). I see the attributes for the signed cert as well as the root cert, but I don't see one for the intermediate cert. I am also wondering if the keystore_file, keystore_password use the option that is present in the webui of "Import Certificate Chain"

Server Attributes:

['arcgis']['server']['keystore_file']
['arcgis']['server']['keystore_password']
['arcgis']['server']['cert_alias']
['arcgis']['server']['root_cert']
['arcgis']['server']['root_cert_alias']

Portal Attributes:

['arcgis']['portal']['keystore_file']
['arcgis']['portal']['keystore_password']
['arcgis']['portal']['cert_alias']
['arcgis']['portal']['root_cert']
['arcgis']['portal']['root_cert_alias']

Help Articles:

https://support.esri.com/en-us/knowledge-base/the-option-to-store-credentials-is-not-visible-when-add-000015387#:~:text=Solution%20or%20Workaround%201%20Disable%20the%20firewall%20on,ArcGIS%20to%20trust%20the%20provided%20SSL%20certificates.%20

https://support.esri.com/en-us/knowledge-base/error-failed-to-federate-data-store-item-000023475

[cameronkroeker]

Hi @J-J-E,

This is a limitation of the current cookbooks, but a valid feature request. At this time the cookbooks can only import the root cert, and signed cert (pfx).

Thanks,
Cameron K.

[J-J-E]

Hey @cameronkroeker,

Is the appropriate method for a feature request to create a new issue? Or should I be logging this request somewhere else? I would personally consider this a bug, as the portal logs are riddled with errors below when attempting functions relying on communication between Portal and Server. I believe a valid SSL configuration is a necessity for any enterprise deployment.

Invalid SSL certificate found. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[cameronkroeker]

It can be logged via the Github issues:

https://github.com/Esri/arcgis-cookbook/issues

And/Or it can be logged with Esri Technical Support, they then can provide an official ENH Id that you can use for tracking the status of it.

Thanks,
Cameron K.

[J-J-E]

As always, thanks so much for your help and clarification!

[J-J-E]

For anyone else who comes across this issue, here is the ENH for tracking this enhancement: ENH-000168761