How to do Handshake with tired party(bank) HTTPS URL from SAP PI server

[Former Member]

Dear Expert,

I have developed bunch of scenarios, all are synchronous ABAP proxy to HTTP_AAE with bank on PI 7.4(dual stack). Bank web server is HTTPS enabled server. Our ABAP developments are still in progress also we have few issue in connection from ECC to PI.but that is not the focus of discussion here.

we want to do the handshake to check the connectivity with bank on their HTTPS URL from PI. Bank has provided the privet key for SSL from their server and corresponding public key they have maintained on their server. I have imported the private key under NWA -> Certificates -> Key Storage -> TrustedCA->Import Entry->Entry Type->PKCS#12->select the SSL.p12 file->import , also I have selected the option to "Use SSL" in HTTP_AAE receiver communication channel and selected the corresponding entryin  "keystore view" and "keystore entry". All these I have done in our DEV system, and we are trying to connect our PI dev to bank Dev server.

Questions

1. Is there any specific steps to do the handshake with third party HTTPS(bank in my case) server? if not, how can we just test the HTTPS connectivity by using the SSL private installed on our PI server, without running the complete scenarios. Our PI has been installed on UNIX, and "telnet https url 443" is working, as network team has opened the HTTPS port.
2. We have not enabled the SSL technically on our PI server, and we have not installed any generated certificate from our PI server. Moreover, we have not made our PI url as "https:hostname:port" as we just need to communicate with bank by using their private key. Do you guys think we should enable the SSL? if yes, please explain why.
3. What is the best practice to test the connection with third party having HTTPS URL? how can I just assure HTTPS communication is working fine, before testing my actual scenarios.

Thanks for helping always.

Regards,

Farhan

[aashish_sinha · Accepted solution]

Hi Farhan,

Follow below weblog.

You might need to import bank certificates in NWA->trusted keystore and then try to post data. Also enable XPI_Inspector check http logs.

Thanks and Regards

Aashish Sinha

[Former Member · Accepted solution]

Hi Aashish,

I Have read your blog many times already, and again I read before posing my thread, this is very nice and helpful blog for sender adapter communication. I mean if third party is sending request to PI server over HTTPS, however in our case we are sending the request to bank on their HTTPs url.

I have already imported bank private key in TrustedCas, do you think certificates are required still? I will request to SAP for XPI_Inspector as well.

Could you please clarify above query regarding enabling SSL, I believe I do not need to enable SSL? please confirm. also how to do handshake with the bank to test HTTPS connection?

Thanks a ton for your prompt help Aashish.

Regards,

Farhan

[aashish_sinha · Accepted solution]

Hi Farhan,

Some part of the blog is applicable for sending HTTPS request to partners/third party (Receiver SOAP Adapter).

If banks certificates are already in trustedCA, then,  can you check if it also imported under user PIISuser under Identity management in NWA. If above 2 steps are done then i think your are good to go. But be careful when you install certificate, it should be in proper order.

As you already mentioned, connectivity is already established and you are able to PIng/telnet from pi server, connectivity looks ok.

While sending request, if you are getting 401 unauthorized, below might be the reason -

1. Certificate not installed correctly or some missing steps

2. Partner or TP is not ready to receive it, some certificate issue in there side.

other than 401 means you are ok (As per certificate and Connectivity) - 403 and 500 errors are next stops.

403 - error because of encoding method.

500 - data issue.

Regards
Aashish Sinha

[Former Member · Accepted solution]

Hi Aashish,

Thanks a lot for the details, so according to you I do not need to enable SSL on PI server, if the privet key has been installed, and selected in HTTP_AAE receiver channel, that is enough, right?

I have seen many threads and blog for doing handshake to check the third party connectivity, is there any standard process to check? or if "telnet bank hostname/IP 443" is working from pi server, then we can assure that handshake is done.

Experts please provide your suggestion.

Thanks,

Farhan