Security Alert messages are returned in ArcGIS Pro after Portal for ArcGIS upgrade

Description

Attempting to sign in to Portal for ArcGIS in ArcGIS Pro after Portal for ArcGIS upgrade returns the following security alert:

Warning:
The certificate you are viewing does not match the name of the site you are trying to view.

A secure connection with this site cannot be verified. Would you still like to proceed?

Warning:
The Certificate Issuer for this site is untrusted or unknown.

A secure connection with this site cannot be verified. Would you still like to proceed?

Cause

The security alert message may be returned due to several reasons but not limited to:

• Mismatch between the WebContextURL property and the web adaptor FQDN (port 443). When Portal for ArcGIS is upgraded, the WebContextURL property may be reset to blank.
• Mismatch in the Fully Qualified Domain Name (FQDN) between the portal hostname referenced in the signed SSL certificate subject Common Name (CN) or Subject Alternative Names (SANs) and the DNS lookup entries returned to the host when the upgrade occurred.
• The SSL certificate issuer is not recognized as trusted by ArcGIS Pro. Despite a certificate issuer listed in an operating system's (OS) Trusted Root Certification Authorities, ArcGIS Pro does not automatically recognize the certificate as trusted or is incompatible with ArcGIS Pro requirements.
• The certificate (self-signed or CA-signed certificate) has expired.
• The CA-signed server root certificate is not imported into Portal for ArcGIS. In certain circumstances, while certificates are imported into the portal, only intermediate or wildcard certificates are imported into Portal for ArcGIS. This causes trust issues between the systems in a hosted federation as the connection the portal is trying to communicate with is not considered a secure connection. Refer to Portal for ArcGIS: Use an existing CA-signed certificate for more information.

Solution or Workaround

Depending on the cause, the workarounds provided are applicable.

Update the WebContextURL property with the FQDN on the ArcGIS Web Adaptor port 443 binding

Update the WebContextURL property to match the FQDN on the web adaptor port 443 binding. Refer to Portal for ArcGIS: Integrate your portal with a reverse proxy or load balancer for more information, and refer to the Set the WebContextURL property section for instructions.

Update the organization URL

If the FQDN between the portal hostname referenced in the signed SSL certificate subject Common Name (CN) or Subject Alternative Names (SANs) and the DNS lookup entries returned to the host when the upgrade occurred do not match, update the organization URL. Refer to Portal for ArcGIS: Update the organization URL for more information.

Replace the SSL certificate with another certificate issued by a different certificate authority

If the SSL certificate issuer is not recognized as trusted by ArcGIS Pro despite being listed in the Trusted Root Certification Authorities list, request a new certificate from a different certificate authority.

Renew certificates

For expired certificate circumstances, generate a new self-signed certificate or request a CA-signed certificate renewal from the issuing certificate authority (CA) for the server. For example, refer to ArcGIS Server: Create a self-signed certificate. Next, import certificates into the Portal Administrator Directory. Refer to Portal for ArcGIS: Import a certificate into the portal for more information and instructions.

Import the server root certificate into Portal for ArcGIS

If the CA-signed server root certificate is not imported into Portal for ArcGIS, import the certificate into the Portal Administrator Directory as an Administrator of the organization. Refer to Portal for ArcGIS: Import the root CA certificate for more information and instructions.