SSL issues: SocketException: Socket already closed

[Former Member]

Hello

for some days we are observing strange errors on our PI systems related to ssl communication failing. For example

Failure at Cache-Refresh data consumption !!!
<?xml version="1.0" encoding="UTF-8"?>
<CacheRefreshError>
  <EngineType>AE</EngineType>
  <EngineName>xx.xxx.xxxxxx</EngineName>
  <RefreshMode>C</RefreshMode>
  <GlobalError>
    <Message>
      Couldn't parse Configuration Data cache update XML string from Directory.
    </Message>
    <Trace>
      java.net.SocketException: Socket already closed.
at iaik.security.ssl.SSLTransport.a(Unknown Source)
at iaik.security.ssl.k.available(Unknown Source)
at java.io.BufferedInputStream.read(BufferedInputStream.java:325)
at com.sap.engine.httpdsrclient.io.ServerInputStreamWrapper.read(ServerInputStreamWrapper.java:49)
[...]

    </Trace>
  </GlobalError>
</CacheRefreshError>

We always get "java.net.SocketException: Socket already closed" also in other situations like sld registration. The error occurs both on a 7.11, 7.31 and 7.4 system. All certificates seem to be ok. On one system we even have it when opening a PI directory object:

I did not find anything helpful in the net. I also have opened a ticket at SAP but gid not get a reply yet.

Any hint will be appreciated.

Regards, Jochen

[Former Member · Accepted solution]

Hi,

today we got an answer from SAP support;

manually replace iaik_ssl.jar and w3c_http.jar under j2ee/cluster/bin/ext/mail-activation-iaik folder of your

installation with those from privious version and restart the server node.

That is a valid workaround. So it seems to be a bug in the mentioned library or how it is used in SAPs code.

Thanks, for your support

[Former Member]

HI

it seems that one of your certs might have expired.

CAn u please have a look in NWA To see which one it was that failed and we will take it from there.

regards

jannus botha

[Former Member]

Hi Jannus,

thanks for your reply. As I wrote the certificates are ok:

I have also checked the url in the error message of the Integration Directory (see second screenshot above) which is "https://<host>:<https port>/rep/query/int?container=any":

I have increased the log level for "com.sap.security.core.server.https.IAIK" to debug but I can see no log output at all when I reproduce the error with the web start client.

Regards, Jochen

[Former Member]

Hi Jochen,

Ok. Lets see if this work.

Do you have a single stack or dual stack?

If dual stack can you please test the following below.

Can you please test the SM59 conenctions and make sure all of them are still working. Can you also please have a look at the logs within the SMICM transaction? There should be a few errors from the error you gave me.

Single stack. Please go to your destinations and RFC connections and make sure they are also working.

If any of those connections are faulty correctify them and try again.

But normally with these strange errors they are normally fixed with a restart. Would it be possible to give your system a bounch?

Regards,

Jannus