WebSphere に Web Adaptor を配置すると、HTTPS 経由で ArcGIS リソースにアクセスできない

説明

In ArcGIS 10.6.1, resources are inaccessible through HTTPS when the Web Adaptor is deployed on WebSphere. This can manifest itself in the following ways:

• When configuring ArcGIS Server with the Java Web Adaptor, the user interface displays the following error message:

Error:
Unable to register the ArcGIS Server with the Web Adaptor. Please make sure that the server machine is running and that the account specified has administrative privileges to the site.

• When configuring Portal for ArcGIS with the Java Web Adaptor, the user interface displays the following error message:

Error:
Unable to configure Portal with the Web Adaptor. Please make sure that the Portal machine is running and that the account specified has administrative privileges to the Portal.

• The error in the WebSphere application server logs is

Error:
Unable to get token for user <username>, Error in admin request for get machines Received fatal alert: handshake_failure.

原因

Starting at ArcGIS 10.6.1, the secure socket layer (SSL) protocol TLSv1 is disabled by default for both Portal for ArcGIS and ArcGIS Server due to Payment Card Industry (PCI) compliance. By default, WebSphere uses SSL-TLS as the SSL handshake protocol, which is SSLv3 and TLSv1, and hence terminates HTTPS connections from the Web Adaptor to the ArcGIS Server and Portal for ArcGIS applications.

Note:
Starting with ArcGIS Web Adaptor for Java 10.3, SSLv3 is no longer supported to prevent the POODLE vulnerability.

解決策または対処法

To use HTTPS with the ArcGIS Web Adaptor on WebSphere, update the WebSphere configuration to use SSL_TLSv2 as the SSL handshake protocol, which is SSLv3 and TLSv1, TLSv1.1, and TLSv1.2.

Follow the instructions below.

1. Log in to the WebSphere Application Server Integrated Solutions Console.
2. Click Security > SSL certificate and key management, and under Related Items, click SSL configurations.
3. Click NodeDefaultSSLSettings (default).
4. Under Additional Properties, click Quality of protection (QoP) settings. QoP settings define the strength of the SSL encryption, the integrity of the signer, and the authenticity of the certificate.
5. Select a protocol for the SSL handshake SSL_TLSv2.
6. Click OK and save directly to the main configuration.

In addition, the WebSphere Java Virtual Machine must be updated to start with SSL protocol TLSv1.1 and TLSv1.2. For this, follow the steps below.
 
In the WebSphere Administrative console:

1. Click Servers > Server Types > WebSphere application servers, and click server1 to open it.
2. Under Server Infrastructure, click Java and Process Management > Process definition.
3. Under Additional Properties, click Java Virtual Machine.
4. In the Generic JVM arguments text box, enter -Dhttps.protocols=TLSv1.1,TLSv1.2
5. Click Apply, OK, and save directly to the main configuration.
6. Restart the application server.

Note: 
The above solution is for Java Web Adaptor working with WebSphere 9. Review the WebSphere documentation for further details on security configuration for the organization level requirements.