ArcGIS Server Manager page not accessible after https/SSL configuration

[EyadHammad]

i was in the middle of configuring ArcGIS Server 10.1 in the rest ADMIN where i was enabling HTTPS only instead of HTTP then imported an SSL certificate when suddenly the connection with the ADMIN page got lost and i could not connect again. i get a message the page could not be displayed or found. i was using https://servername:6443/ArcGIS/manager and https://serverName:6443/arcgis/admin/security/config but after i lost the connection, i am not able to open the ArcGIS server pages. in addition, i could not connect using http with port 6080. Moreover, i could not connect to ArcGIS server from ArcCatalog as its complaining about a BAD address.

i forgot to mention that i checked the service for ArcGIS server and confirmed it is running. i even restarted the service several times and restarted the host server with no luck.

we are running ArcGIS server 10.1 on Windows Sever 2008 R2 environment NO web adapter configured

how to re-establish the connection to ArcGIS Server manager or rest pages ?

is there a way to reset the configuration from HTTPS only to HTTPs and HTTP ?

is there a way to default back these security changes in ArcGIS Server ?

appreciate any input

thanks

[EyadHammad]

i forgot to mention that i checked the service for ArcGIS server and confirmed it is running. i even restarted the service several times and restarted the host server with no luck.

[RandallWilliams]

Esri support services should be able to help you get your site back to allowing a connection on 6080 (http). It's best to test with both http and https enabled before switching to https only to verify that the SSL certificate will work with ArcGIS Server.

[RichardWatson]

I would search through all the ArcGIS Server configuration files for the one which stores this setting and try updating that.

Another alternative is to clean ArcGIS Server off the machine and reinstall it.  By clean, I mean that you uninstall it and manually remove any files related to it from the file system.  Just uninstalling the software is typically insufficient.

If you have backups then another alternative is to roll the server back to a point before you made these changes.

Of course, as pointed out by Randall, support services is another option for you.

[WilliamCraft]

how to re-establish the connection to ArcGIS Server manager or rest pages ?

is there a way to reset the configuration from HTTPS only to HTTPs and HTTP ?

is there a way to default back these security changes in ArcGIS Server ?

I believe that the HTTP Only, HTTP and HTTPS, and HTTPS Only settings for the protocol under Security --> Config in AGS Manager pertain to the web adaptor, so altering the value as you mentioned should not cause the issue especially since you said that no web adaptor had been configured and your URL requests use a port number.  Based on the info you provided, I would suspect the importing of another security certificate to be the culprit for the time being.  It sounds like SSL was working just fine for you initially.  A few things to try and/or consider first...

Did you import a CA-signed certificate to replace the default self-signed certificate in AGS?  If so, did you use the importRootorImmediate option or the importExistingServerCertificate option?  If it's a CA-signed certificate, take a look at the certification path properties for that certificate and verify that all of the certs in the path (i.e., the root cert, any intermediary certs, and the cert itself) exist in the Trusted Root Certification Authority on the AGS machine.  You'll know if all of them are trusted when you view the certification path properties depending on whether or not a red X appears next to any of them. 

Alternatively, if you need to "clear out" any changes you made regarding the security certificates to get things back to normal per se, you MIGHT be able to try the following:
1. On the server, go to C:\arcgisserver\config-store\machines and open the <servername>.json file (assumes AGS was installed at C:\arcgisserver) using Notepad or Notepad++.  Make a backup of the file in the same directory, first. 
2. In that file, find the section with "webServerCertificateAlias" and change the value after the colon to be exactly selfsignedcertificate surrounded by double quotes just as you see with the current value.  If it's already set to this value, then more than likely you did not try to import a CA-signed certificate into AGS and this most likely isn't your issue. 
3. Save the file and then re-start the ArcGIS for Server Windows service. 
4. After about a minute following restart of the service in #3 above, try re-requesting the URLs you mentioned to see if the behavior is different.  If so, then refer back to the second paragraph of my reply and make sure that, if using a CA-signed certificate, you follow the proper steps to ensure it is trusted on the AGS machine along with any of its intermediary and root certs.  If not, then revert back to the backup file created in #1 above and restart the AGS service again since this probably isn't the correct issue and associated fix.

[divyamgulati1]

In the config store under the security folder, you have to make changes in the json file. Stop the Arcgis server service from the windows services panel and set the ssl enabled= false in this json configuration file..

[EyadHammad]

Esri support services should be able to help you get your site back to allowing a connection on 6080 (http). It's best to test with both http and https enabled before switching to https only to verify that the SSL certificate will work with ArcGIS Server.

Thanks,

i opened a channel with local ESRI distributer and hopefully they can help in this regard

[EyadHammad]

I would search through all the ArcGIS Server configuration files for the one which stores this setting and try updating that.

Another alternative is to clean ArcGIS Server off the machine and reinstall it.  By clean, I mean that you uninstall it and manually remove any files related to it from the file system.  Just uninstalling the software is typically insufficient.

If you have backups then another alternative is to roll the server back to a point before you made these changes.

Of course, as pointed out by Randall, support services is another option for you.

our local ESRI distributer recommended a re-installation .. i am somewhat hesitant to go through that as i would like to know first what caused and how to avoid this in the future .. its a good idea to seach for SSL saved configuration .. i'm planning to do that shortly

unfortunately, we don't have ArcGIS Server backups .. otherwise, it would have been an easy recovery. i am planning to do that backup in the future. thanks

[EyadHammad]

I believe that the HTTP Only, HTTP and HTTPS, and HTTPS Only settings for the protocol under Security --> Config in AGS Manager pertain to the web adaptor, so altering the value as you mentioned should not cause the issue especially since you said that no web adaptor had been configured and your URL requests use a port number.  Based on the info you provided, I would suspect the importing of another security certificate to be the culprit for the time being.  It sounds like SSL was working just fine for you initially.  A few things to try and/or consider first...

Did you import a CA-signed certificate to replace the default self-signed certificate in AGS?  If so, did you use the importRootorImmediate option or the importExistingServerCertificate option?  If it's a CA-signed certificate, take a look at the certification path properties for that certificate and verify that all of the certs in the path (i.e., the root cert, any intermediary certs, and the cert itself) exist in the Trusted Root Certification Authority on the AGS machine.  You'll know if all of them are trusted when you view the certification path properties depending on whether or not a red X appears next to any of them. 

Alternatively, if you need to "clear out" any changes you made regarding the security certificates to get things back to normal per se, you MIGHT be able to try the following:
1. On the server, go to C:\arcgisserver\config-store\machines and open the <servername>.json file (assumes AGS was installed at C:\arcgisserver) using Notepad or Notepad++.  Make a backup of the file in the same directory, first. 
2. In that file, find the section with "webServerCertificateAlias" and change the value after the colon to be exactly selfsignedcertificate surrounded by double quotes just as you see with the current value.  If it's already set to this value, then more than likely you did not try to import a CA-signed certificate into AGS and this most likely isn't your issue. 
3. Save the file and then re-start the ArcGIS for Server Windows service. 
4. After about a minute following restart of the service in #3 above, try re-requesting the URLs you mentioned to see if the behavior is different.  If so, then refer back to the second paragraph of my reply and make sure that, if using a CA-signed certificate, you follow the proper steps to ensure it is trusted on the AGS machine along with any of its intermediary and root certs.  If not, then revert back to the backup file created in #1 above and restart the AGS service again since this probably isn't the correct issue and associated fix.

i appreciate your effort

you are right, as i am trying to remember what could have been the cause, yes everything collapsed after i imported a CA-Signed certificate. i did not replace the existing sefl-signed default certificate. i just imported an additional one that was previousely generated and signed by our coportate CA authority. i have been reading about this issue and found out post saying you cannot import a certificate created outside ArcGIS server in 10.1 and this might be different for 10.2 .. our ultimate goal is to have all our services secured and delivered to our proponents in in HTTPS.

i'll follow your steps and hopefully i can get the instance up and running again

thanks again

[EyadHammad]

In the config store under the security folder, you have to make changes in the json file. Stop the Arcgis server service from the windows services panel and set the ssl enabled= false in this json configuration file..

Hey there,

thanks for the tip. i'll try to do that and hope it works