0

I am trying to update the SSL cipher suites (to be in compliance with my org security requirements) at '/portal/portaladmin/security/sslCertificates/update' according to this page

I am getting: Error: One or more invalid HTTPS cipher suites

I have checked and all cipher suites I am using are compatible according to the linked page

I could not find any information on this issue. Has anyone successfully changed the cipher suites this way?

EDIT: The cipher suites I want to set:

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA

  • Are you able to share the cipher suites you want to use? – Don Oct 12 '17 at 16:24
  • added cipher suites – Alec Patrizio Oct 12 '17 at 21:11
1

I tested the cipher suites in my test ArcGIS Server 10.5.1 (by mistake), they worked there. I did encounter the same error you got in Portal 10.5.1. I cut the chase by directly updating the file on disk. The file updated when you change the cipher suites in Portal is located at "C:\Program Files\ArcGIS\Portal\framework\runtime\tomcat\conf" assuming you installed Portal on C:. It's the "server.xml" file. I backed up mine and then directly added your cipher suites. That was after stopping Portal. It restarted successfully after that. Took a little longer.

enter image description here

enter image description here

enter image description here

| improve this answer | |
  • Thanks for the response. It turns out I actually need to do this on the server machine as well. It doesn't seem to be working for me there. I'm guessing i can try to directly update the config file like you did with portal? – Alec Patrizio Oct 13 '17 at 19:21
  • Yes. For Server, the file should be at "C:\Program Files\ArcGIS\Server\framework\runtime\tomcat\conf\server.xml". Stop the Server, back up the file before you make any changes to the list of ciphers. The Cipher list will be at the bottom of the file. I updated the answer to include a picture of the Server Ciphers. – Don Oct 13 '17 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.