ArcGIS Survey123: SSL handshake failed (6). Error 6: The certificate has expired

Error Message

When attempting to connect to an ArcGIS Enterprise deployment from ArcGIS Survey123 on an Android device, users may encounter the following error message:

SSL handshake failed (6) 
Error 6: The certificate has expired

This issue prevents users from successfully authenticating and accessing web maps, feature layers, or other resources published in the ArcGIS Enterprise environment.

Cause

A common cause of this behavior is an expired SSL/TLS web server certificate used by the ArcGIS Enterprise deployment. ArcGIS Survey123 relies on a secure HTTPS connection to communicate with ArcGIS Enterprise. If the server certificate has expired, Android devices will reject the secure connection because the certificate can no longer be validated.

Certificates issued by a trusted Certificate Authority (CA) are essential for establishing a trusted communication channel between client applications and ArcGIS Enterprise. Once the certificate expires, the TLS handshake fails, preventing ArcGIS Survey123 from establishing a secure connection and resulting in the error described above.

This issue can affect all ArcGIS Enterprise components exposed through HTTPS, including Portal for ArcGIS, ArcGIS Server, ArcGIS Web Adaptor, and other applications, depending on the deployment architecture.

Solution or Workaround

The issue can be resolved by replacing the expired SSL/TLS certificate with a new, valid certificate issued by a trusted Certificate Authority (CA). After the certificate has been renewed and correctly configured, all ArcGIS Enterprise components should trust the updated certificate chain, allowing ArcGIS Survey123 to establish a secure connection successfully.

The following steps describe how to import and configure the new SSL/TLS certificate across the ArcGIS Enterprise components:

Import the SSL Certificate into Portal for ArcGIS

1. Sign in to the Portal for ArcGIS Administrator Directory by navigating to:

https://machine.domain.com/<webadaptor>/portaladmin

2. Navigate to Security > SSLCertificates > Import Existing Server Certificate.
3. Import the new certificate by providing the following information:
   • The password for the .pfx certificate file.
   • A certificate Alias (this can be any descriptive name).
   • Browse to and select the certificate file.
4. Click Import to complete the process.
5. After the import is successful, return to the SSLCertificates page and verify that the newly imported certificate appears in the list.
6. Select Update and configure the imported certificate as the active Web Server SSL Certificate by specifying the certificate alias.
7. Verify that Portal for ArcGIS is serving the new certificate by accessing the following URL:

https://machine.domain.com:7443/arcgis

Confirm that the browser reports a valid HTTPS connection and that the new CA-issued certificate is presented.

Import the SSL Certificate into ArcGIS Server

1. Open the ArcGIS Server Administrator Directory:

https://gisserver.domain.com:6443/arcgis/admin

2. Navigate to Machines > <ServerName> > sslCertificates > Import Existing Server Certificate.
3. Import the certificate by providing:
• The password for the .pfx file.
• A certificate Alias.
4. Click Submit to complete the import.
5. Once the certificate has been imported, navigate to: Home > Machines > <ServerName> > Edit.
6. Under Web Server SSL Certificate, specify the alias of the newly imported certificate.
7. Save the changes and wait for ArcGIS Server to restart the affected services and apply the new SSL/TLS configuration.
8. Validate that ArcGIS Server is presenting the new certificate by opening:

https://gisserver.domain.com:6443/arcgis/admin

After the certificate has been replaced in both Portal for ArcGIS and ArcGIS Server, verify the following:

• ArcGIS Enterprise is accessible over HTTPS without certificate warnings.
• The certificate chain is trusted by the client device.
• ArcGIS Survey123 can successfully authenticate against Portal for ArcGIS.