Import a new SSL certificate into a standalone ArcGIS Server environment to replace an expiring one using a certificate provide by a third-party certificate authority

Summary

In some circumstances, customers download SSL certificates provided by third-party certificate authorities that do not provide the .pfx file needed to import into ArcGIS Server Admin. In these situations, customers must manually convert the downloaded files, then import the certificate into IIS to obtain the .pfx.

Procedure

The following steps cover manually downloading the file from the certificate authority, converting it to a .cer, importing and installing the certificate, binding it to the appropriate port, then exporting the .pfx and importing it into Server admin:

1. Download the new certificate from the desired Certificate Authority.
2. Convert the .crt file to a .cer file.
   1. Locate the downloaded .crt file, and double-click it to open it.
   2. Select the Details tab, and click Copy to File.
   3. Select Next in the Certificate Wizard.
   4. Select Base-64 encoded X.509(.CER) and click Next.
   5. Select Browse to choose where to save the .cer file and give it a name.
   6. Select Next and click Finished.
3. Copy the certificate files onto the server.
   • Find the directory on the server where certificate and key files are stored, and upload the intermediate certificate (xxxxx.p7b or similar) and primary certificate (.cer file that was just converted) into that folder.
4. Import the Intermediate SSL Certificate.
   1. In the Microsoft Management Console (MCC), click ▶ to expand Certificates (Local Computer).
   2. Right-click the Intermediate Certification Authorities folder, hover over All Tasks, and click Import.
   3. In the new window, click Next.
   4. Click Browse, find the .p7b intermediate certificate file, and click Open.
   5. Click Next and click Finish.
   6. Close the Import was successful message.
5. Install the SSL certificate.
   1. Launch the Internet Information Services (IIS) Manager.
   2. Under the Connections panel on the left, click the Server Name.
   3. In the main panel under the IIS section, double-click Server Certificates.
   4. Under the Actions panel on the right, click Complete Certificate Request.
   5. On the new window, click the ellipis (…) and browse to and find the previously uploaded primary certificate file. Click Open.
   6. Add a name to easily identify this certificate.
   7. In the Certificate store option, select Personal, and click OK.
6. Bind the SSL certificate.
   1. Under the Connections panel on the left, click ▶ to expand the Sites folder.
   2. Click the Site Name that the SSL certificate must be installed on.
   3. Under the Actions panel on the right, find the Edit Site section and click Bindings.
   4. On the new window, click Add and fill out the following information:
      1. Type: https
      2. IP Address: select All Unassigned
      3. Port: 443
      4. Host name: leave empty
      5. SSL Certificate: select the recently installed SSL
   5. Click OK to confirm, and close the Site Bindings window.
7. Restart IIS.
8. Export the .pfx file.
   1. In the IIS Manager, double-click Server Certificates.
   2. Click the machine name.
   3. On the right-hand side, click Export.
   4. This should bring up the option to Export to and set a password - double-check that it's exporting as .pfx by clicking the ellipsis (…) on the right-hand side of the Export to box and noting the file extension.
9. Import the SSL certificate into Server Admin.
   1. In the browser, navigate to the Server Admin endpoint (https://<yourMachineName>.esri.com/server/admin) and log in.
   2. From Home, click machines.
   3. Click the machine.
   4. Click sslcertificates.
   5. Click importExistingServerCertificate.
   6. Browse to and upload the certificate file.
   7. Choose an alias name and enter the password created while exporting the .pfx from IIS.
   8. Click Submit.