EAEP2201 practice question 5 of 15

A GIS administrator is responsible for maintaining the stability of a large internal ArcGIS Enterprise deployment. After the Domain CA certificate is…

A GIS administrator is responsible for maintaining the stability of a large internal ArcGIS Enterprise deployment. After the Domain CA certificate is replaced with a new one and the new PKCS#12 format PFX file is imported into all Portal for ArcGIS, ArcGIS Server, and ArcGIS Data Store deployments, the following issues are identified: When connecting directly to the Portal for ArcGIS administration endpoint via port 7443, the new certificate is not recognized and is considered invalid When connecting directly to the ArcGIS Server administration endpoint via port 6443, the new certificate is not recognized and is considered invalid When connecting to the ArcGIS Data Store endpoint via port 2443, the new certificate is recognized and considered valid What is causing this issue?

Answer options

A: ArcGIS Server and Portal for ArcGIS require that new root and new issuing authority certificates be imported explicitly into the software Correct answer

B: Domain CA certificates are no longer supported by ArcGIS Server and Portal for ArcGIS and should be replaced by self-signed certificates

C: Domain CA certificates must be imported using a DER encoded binary X.509 (CER) format file for ArcGIS Server and Portal for ArcGIS

D: ArcGIS Server and Portal for ArcGIS are not compatible with PKCS#12 certificates

Correct Answer:

A. ArcGIS Server and Portal for ArcGIS require that new root and new issuing authority certificates be imported explicitly into the software

Explanation

ArcGIS Enterprise components like Portal for ArcGIS and ArcGIS Server maintain their own certificate trust stores. When a new server certificate from a Domain Certificate Authority (CA) is imported (typically via a PKCS#12/PFX file), the software must be able to validate the entire certificate chain up to a trusted root. If the new certificate was issued by a new or different intermediate or root CA, those CA certificates must be explicitly imported into the trust stores of both Portal and ArcGIS Server. The fact that the ArcGIS Data Store accepts the certificate while Portal and Server do not indicates a trust chain validation failure specific to the Portal and Server components, which is resolved by importing the necessary CA certificates.

Why Incorrect

B: Domain CA certificates are a standard and recommended security practice for internal ArcGIS Enterprise deployments; they are fully supported. C: The PKCS#12 (PFX) format is correct for importing a server certificate that includes its private key. The DER/CER format is used for importing public root or intermediate CA certificates into the trust store. D: ArcGIS Server and Portal for ArcGIS are fully compatible with and support the import of certificates using the PKCS#12 (PFX) format.

References

1. Esri Official Documentation - ArcGIS Enterprise (Portal for ArcGIS): In the section on importing a certificate

the documentation states

"If you're using a new certificate from a CA that is not trusted by default

you must import the CA root and intermediate certificates into the portal." This confirms that the full chain of trust must be established by importing the issuing authority's certificates.

Source: ArcGIS Enterprise 11.0 Documentation

"Portal for ArcGIS > Administer > Security > Import a certificate into the portal".

2. Esri Official Documentation - ArcGIS Enterprise (ArcGIS Server): The documentation for securing ArcGIS Server with HTTPS explicitly notes the requirement to import the CA's certificates. "If the certificate is from a CA

you must also import the root and/or intermediate certificates of the CA into the site." This directly addresses the scenario where the server certificate is not recognized because its issuer is not trusted.

Source: ArcGIS Enterprise 11.0 Documentation

"ArcGIS Server > Administer > Security > Configure HTTPS on ArcGIS Server".

Keep practicing

Take the free EAEP2201 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test