The Patch Notification Utility reports "Your computer appears to be offline. Check your internet connection and try again."

Description

This applies to ArcGIS Server, Portal for ArcGIS and ArcGIS Data Store. 

When opening the link "https://downloads.esri.com/patch_notification/patches.json" in a web browser on the machine loads successfully, this indicates that the URL is not being blocked.

However, the Patch Notification Utility reports "Your computer appears to be offline. Check your internet connection and try again." even though the link is accessible from the machine.

The patchnotification.bat file, located in C:\Program Files\ArcGIS\Server\tools\patchnotification, can be run with a "-v 2" added to the end for more information. For example:

patchnotification.bat -v 2

Running this command in a command prompt gives verbose level 2 output. In the output, near the end, if it shows a message like "IO exception: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ", then the issue is caused by the ArcGIS software not trusting the certificate chain presented by the patch notification website.

Cause

When opening the https://downloads.esri.com/patch_notification/patches.json link in a web browser and viewing the certificate information of the website in the browser, the Root certificate appears to be issued by a different Certification Authority (CA), not DigiCert. 

The following screenshot shows the typical certificate chain when accessed from Esri's network:

If, on the ArcGIS Enterprise machine, this website shows a different CA, such as the organization's internal CA, as the issuer of the root certificate, this "untrusted" root certificate must be added to the trusted root CAs in Portal for ArcGIS, ArcGIS Server, and/or ArcGIS Data Store to allow their patch notification tool to connect to the website.

Solution or Workaround

Export the "untrusted" root certificate from the https://downloads.esri.com/patch_notification/patches.json website in browser on the machine using the Export button in the browser Certificate Viewer to save the root cert as a .cer or .crt.

For ArcGIS Server

Navigate to ArcGIS Server admin endpoint. Select machines > [machine name] > sslcertificates > importRootOrIntermediate, and upload the .cer or .crt and provide an alias. It is not necessary to restart ArcGIS Server.

For Portal for ArcGIS

1. Navigate to the ArcGIS Portal Admin endpoint. Select  Security > SSLCertificates > Import Root or Intermediate.
   • For a High Availability environment, navigate to Machines > [machine] > SSLCertificates > Import Root or Intermediate and perform the same steps for each portal machine.
2. Upload the .cer or .crt and provide an alias. It is not necessary to restart Portal.

For ArcGIS Data Store

Since there is no GUI for importing a root certificate to Data Store, in an elevated command prompt:

1. Navigate to the following:

C:\Program Files\ArcGIS\DataStore\framework\runtime\jre\bin

2. From there, run the following command:

keytool -list -ca-certs

That command should list all the current root certs in Data Store's CA keystore. If prompted for a password, the default password is "changeit". 

To import the root certificate, run this command from that same bin location, replacing path\to\Root.cer with the actual root cert information and replacing friendlyName with an alias for the cert to more easily find it in the keystore.:

keytool -import -file path\to\Root.cer -alias friendlyName -ca-certs

If prompted for a password, use the "changeit" password again. After importing, the "keytool -list -ca-certs" command can be run again and see if the number of entries has increased by one and if the root certificate is present in the list now. 

Patch notification should work properly after uploading this root cert to the internal keystore.