ArcGIS Enterprise 使用 HTTPS，这需要为 ArcGIS Notebook Server 配置数字证书。从 2017 年开始，Chrome Internet 浏览器仅信任具有主题备选名称 (SAN) 参数的域证书。此参数不能由 IIS 管理器应用程序单独配置，这意味着从该工作流产生的证书不受 Chrome 的信任。
在大多数情况下，您的 IT 管理员将为您提供必要的 CA 签名证书。以下脚本将创建一个包含 SAN 的证书，并以随后可导入 ArcGIS Notebook Server 站点的格式将其从 IIS 管理器中导出。
保存并运行证书脚本
要创建域证书，您的域必须具有证书颁发机构，并且您的计算机必须已安装 IIS 管理器。最好在 Windows PowerShell ISE 环境下进行此工作流，因为该环境可提供脚本窗口和命令提示符窗口。
- 在计算机上使用以管理员身份运行选项打开 Windows PowerShell ISE 应用程序，并创建新脚本。
- 将以下文本复制并粘贴到应用程序的脚本窗口中。
- 将脚本另存为 .ps1 文件，例如 certificateScript.ps1。
- 在 ISE 应用程序的命令提示符面板中，将目录更改为保存脚本的位置，然后运行以下脚本：.\certificateScript.ps1
将在 PowerShell 中运行的证书脚本
function New-CertificateRequest {
param ( [string]$hostname )
$CATemplate = "WebServer"
$CertificateINI = "cert.ini"
$CertificateREQ = "cert.req"
$CertificateRSP = "cert.rsp"
$CertificateCER = "cert.cer"
$Subject = 'Subject="CN=' + $hostname + '"'
$FriendlyName = 'FriendlyName=' + $hostname
$SAN = '_continue_ = "dns=' + $hostname + '&"'
### INI file generation
new-item -type file $CertificateINI -force
add-content $CertificateINI '[Version]'
add-content $CertificateINI 'Signature="$Windows NT$"'
add-content $CertificateINI ''
add-content $CertificateINI '[NewRequest]'
add-content $CertificateINI $Subject
add-content $CertificateINI 'Exportable=TRUE'
add-content $CertificateINI 'KeyLength=2048'
add-content $CertificateINI 'KeySpec=1'
add-content $CertificateINI 'KeyUsage=0xA0'
add-content $CertificateINI 'MachineKeySet=True'
add-content $CertificateINI 'ProviderName="Microsoft RSA SChannel Cryptographic Provider"'
add-content $CertificateINI 'ProviderType=12'
add-content $CertificateINI 'SMIME=FALSE'
add-content $CertificateINI 'RequestType=PKCS10'
add-content $CertificateINI $FriendlyName
add-content $CertificateINI '[Strings]'
add-content $CertificateINI 'szOID_ENHANCED_KEY_USAGE = "2.5.29.37"'
add-content $CertificateINI 'szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"'
add-content $CertificateINI 'szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2"'
add-content $CertificateINI 'szOID_SUBJECT_ALT_NAME2 = "2.5.29.17"'
add-content $CertificateINI '[Extensions]'
add-content $CertificateINI '2.5.29.17 = "{text}"'
add-content $CertificateINI $SAN
### Certificate request generation
if (test-path $CertificateREQ) {del $CertificateREQ}
certreq -new $CertificateINI $CertificateREQ
### Online certificate request and import
if ($OnlineCA) {
if (test-path $CertificateCER) {del $CertificateCER}
if (test-path $CertificateRSP) {del $CertificateRSP}
certreq -submit -attrib "CertificateTemplate:$CATemplate" -config $OnlineCA $CertificateREQ $CertificateCER
certreq -accept $CertificateCER
}
### Delete certificate request files
if (test-path $CertificateINI) {del $CertificateINI}
if (test-path $CertificateREQ) {del $CertificateREQ}
if (test-path $CertificateRSP) {del $CertificateRSP}
if (test-path $CertificateCER) {del $CertificateCER}
}
## Main
if ($args.length -ne 0) {$hostname = $args[0]}
else {$hostname = "$env:computername.$env:userdnsdomain".ToLower()}
# Check if a CA exists in the domain and if IIS is installed
if (@(certutil -dump | select-string "Config:")) {
$OnlineCA = (certutil -dump | select-string "Config:").Line.replace("``",'"').replace("'",'"').split('"')[1]
} else {
Write-Host "Unable to determine certificate authority (CA) for this domain"
Exit
}
if (-not @(Get-Service W3SVC -ErrorAction Ignore)) {
Write-Host "IIS is not installed on this machine"
Exit
}
# Generate a certificate for the local machine if one does not already exist
if (@(Get-ChildItem cert:\LocalMachine\My | where-object { $_.FriendlyName -like "$hostname" }).count -eq 0) {
New-CertificateRequest -hostname $hostname > $null
Write-Host "Created a new certificate for $hostname"
} else {
Write-Host "A certificate for $hostname already exists"
}
# Create https binding if necessary and add new cert to https binding
import-module WebAdministration
if (@(Get-WebBinding -name "Default Web Site" | Where-Object {$_.protocol -match "https"}).count -eq 0) {
Write-Host 'Creating https binding for "Default Web Site"'
New-WebBinding -name "Default Web Site" -Protocol https -Port 443
}
if (@(netsh http show sslcert ipport="0.0.0.0:443" | select-string -pattern "IP:port").count -ne 0) {
netsh http delete sslcert ipport="0.0.0.0:443" > $null
}
$cert = (Get-ChildItem cert:\LocalMachine\My | where-object { $_.FriendlyName -like "$hostname" } | Select-Object -First 1).Thumbprint
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert ipport="0.0.0.0:443" certhash=$cert certstorename=MY appid="$guid" > $null
Write-Host "Updated https binding to use certificate for $hostname"
# Export certificate to .pfx if it doesn't already exist (Windows 2012 and higher)
$scriptPath = split-path -parent $MyInvocation.MyCommand.Definition
if ([Environment]::OSVersion.Version -ge (new-object 'Version' 6,2)) {
$pfxname = $hostname.Split(".")[0]
if ($pfxname -eq '*') {$pfxname = "wildcard"}
$pfxname = $pfxname + ".pfx"
if (-Not (test-path $scriptPath\$pfxname)) {
$pfxpwd = ConvertTo-SecureString -String "certificate" -Force -AsPlainText
$cert = (Get-ChildItem cert:\LocalMachine\My | where-object { $_.FriendlyName -like "$hostname" } | Select-Object -First 1).Thumbprint
Get-ChildItem -Path cert:\localMachine\My\$cert | Export-PfxCertificate -FilePath $scriptPath\$pfxname -Password $pfxpwd -ChainOption EndEntityCertOnly > $null
Write-Host "Certificate for $hostname successfully exported to $scriptPath\$pfxname with password 'certificate'"
}
}
# Export domain CA root certificate to domainRoot.cer
if (-Not (test-path $scriptPath\domainRoot.cer) -And ($OnlineCA)) {
certutil -config $OnlineCA '-ca.cert' $scriptPath\domainRoot.cer > $null
Write-Host "Domain root certificate exported to $scriptPath\domainRoot.cer"
}将新证书导入 ArcGIS Notebook Server
这些步骤概述了如何导入通过脚本导出的两个证书文件：.cer 格式的域根证书和 .pfx 格式的服务器证书。应将这两个文件置于保存脚本的相同文件夹中；执行脚本时，在命令提示符输出中也将提供这两个文件位置。
- 登录 ArcGIS Notebook Server Administrator Directory，路径为 https://notebookserver.domain.com:11443/arcgis/admin。
- 浏览至计算机 > <计算机名称> > sslcertificates 并单击 importRootOrIntermediate。
- 按照步骤 3 输入别名并浏览到 domainRoot.cer 文件的位置。单击导入。
- 浏览回计算机页面并单击 importExistingServerCertificate。
- 再次提供证书密码和 .pfx 证书在您计算机上的位置。单击提交。
- 返回计算机页面并单击编辑。
- 使用新域证书的别名替换 Web 服务器 SSL 证书的值。单击保存编辑。服务器计算机将重启，这会花费几分钟时间。