While running SUM SP14 to upgrade Bi system following error appears on 2nd screen in DSUGui after connecting to the GUI port

[Former Member]

While running SUM SP14 to upgrade Bi system following error appears on 2nd screen in DSUGui after connecting to the GUI port:

Feb 29, 2016 5:35:38 AM [Error]: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown

Feb 29, 2016 5:35:38 AM [Error]: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown

Feb 29, 2016 5:35:38 AM [Error]: Network input/output exception has occurred: Received fatal alert: certificate_unknown

Feb 29, 2016 5:35:38 AM [Error]: com.sap.sdt.engine.core.communication.ProxyException

From a previous thread it looks like it may be related to JVM version .. Java version is as follows

java version "1.4.2"

Java(TM) 2 Runtime Environment, Standard Edition (build 2.3)

IBM J9 VM (build 2.3, J2RE 1.4.2 IBM J9 2.3 AIX ppc64-64 j9ap64142-20090310 (JIT enabled)

J9VM - 20090309_31291_BHdSMr

JIT  - 20090210_1447ifx1_r8

GC   - 200902_24)

Need some suggestion if its really related to JVM and I need to go for any specific JVM version or any certificate related activity needs to be performed!

My system is SAP Netweaver 7.4 ABAP. No AS java is installed in this box.

[Former Member · Accepted solution]

We have got a Solution.
Apparently removing MD5 from java.security file
in /SUM/jvm/jre/lib/security from the following parameter removes this
error.

jdk.certpath.disabledAlgoritms=MD2,MD5, RSA keySize < 1024
jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768

Those who are getting the same might find this useful.. We could resume SUM after removing MD5 from these parameters

[Former Member]

Hallo,

might be worth to use the latest SUM instead.

Regards

Thomas.

[Former Member]

Isnt latest (SP15 & SP16) SUM is applicable for Hana only? I don't think we can use them for NW 7.4! Correct me if I am wrong on this!

[Former Member]

Hallo,

from note 2257241:

Please use the SUM 1.0 SP15  for the following cases  :

- Converting SAP systems to S/4 HANA, on-premise edition
- Upgrading or Updating to SAP Business Suite 7 Innovation 2016 based on SAP NetWeaver 7.5)
- Upgrading or Updating to SAP NetWeaver 7.5
- Applying Support Packages Stacks to systems based on SAP NetWeaver 7.5

Use Software Update Manager 1.0 SP14 for all other system maintenance processes.

So, it depends which NW version you are going to.

Regards

Thomas.

[Former Member]

I am doing SP stack upgrade on NW 7.4 .. not upgrading release!

[Former Member]

Hallo Mithun,

if you are just doing SPs you could also apply them using SPAM as a work around, no need to use SUM.

Regards

Thomas

[Former Member]

Yes Thomas, I know that.. But when going from stack level 7 to 13 and updating all components to maximum available SPs, its easier to create stack.xml and proceed with SUM rather than calculating all dependencies yourself and downloading them and UNCARing them on your own one by one before running SPAM.  Don't you think so?

[Former Member]

Hallo,

it was just an idea if you need to get going with your patching: let MOPZ do the calculating, download, apply with SPAM plus kernel patch.

Some users in the thread indicate this being an issue with SP14. Maybe worth trying SP13 (if it's still around)?

Regards,

Thomas.

[Former Member]

SP13 is not found in marketplace but i had the old SAR. But the keyword note is again in unreleased status.

[Former Member]

Hallo,

I had a look through my old documentation but couldn't find the keyword either.

I hope you had better luck with other suggestions (e.g. MD5) in the meantime!!

Regards

Thomas

[former_member185239]

Dear Mithun,

You need to uninstall the java jdk 8 along with the update files.

You have to install jdk 6 or jdk 8 with update 66 to resolve the issue.

You have to install the jdk on the system where you are opening the SUM gui.

Its a bug with SUM SP14.

Also check the below thread

SUM javax.net.ssl.SSLHandshakeException: Receiv... | SCN

With Regards

Ashutosh Chaturvedi

[Former Member]

I am opening DSUGui on the same system and using Hummingbird to fetch the GUI. I have already posted the Java version of the system..

java version "1.4.2"

Java(TM) 2 Runtime Environment, Standard Edition (build 2.3)

IBM J9 VM (build 2.3, J2RE 1.4.2 IBM J9 2.3 AIX ppc64-64 j9ap64142-20090310 (JIT enabled)

J9VM - 20090309_31291_BHdSMr

JIT  - 20090210_1447ifx1_r8

GC   - 200902_24)

Problem is its IBM Java, I don't know which version it relates to for Sun or SAP JVM

[Former Member]

Found this in the log..

com.sap.sdt.engine.core.communication.FactoryAlreadyRegisteredException: Factory for key 'com.sap.sdt.engine.core.communication.FactoryKey@d3a87346' is already registered

anything makes sense?

[Former Member]

Hallo,

That's all I can find:

However, here the error appears after SUM has been already running.

Not sure if this applies to your environment.

Regards

Thomas.

[Sriram2009]

Hi Mithun.

com.sap.sdt.engine.core.communication.FactoryAlreadyRegisteredException: Factory for key 'com.sap.sdt.engine.core.communication.FactoryKey@d3a87346' is already registered

Refer the SAP KBA 2257775 - SUM error: The connection to the SL Controllers down

Regards

SS

[Former Member]

SL controller is not down, DSUGui is also openning.. problem is, its failing to connect to SL controller due to that certificate error.

[Sriram2009]

Hi Mithun.

Thanks for your information. Could you attach the dsuservice.log and sdtserver.log files

Regards

SS

[Former Member]

Hallo,

SUM comes with its own Java and I pretty sure the version you posted is the Java installed on your server and not the one which comes with SUM.

SUM Java is located in SUM/jvm/jre/bin.

Usually there is no need to set the JAVA_HOME to the SUM Java but you can still try, refer to note

2099826 - Error occurs at "Verifying Certificates" step of SUM tool.

Regards

Thomas.

[Former Member]

That note is in not released status

[Former Member]

Hallo,

I can view it without any issues. I will post it below.

Regards

Thomas

Symptom

Starting SUM tool fails at "Verifying Certificates" and the following error logged into the traces:

[Info  ]: Getting missing certificates for host and instance with #5 ...
[Error ]: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
[Error ]: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
[Info  ]: Getting missing certificates for host and instance with #15 ...
[Error ]: The following problem has occurred during step execution: com.sap.sdt.util.diag.DiagException: The sapcontrol service certificate is not trusted for host, instance 5. For more information, see section "Verifying Certificates" in the SUM guide.

Resolution

1. Set the JAVA_HOME path to the JVM of the SUM tool to be sure that keystore of this JVM will be used
3. Start Internet Explorer and call the URL http://hostname:5NN14 - where NN is the instance number to get the SSL certificate of the server
5. Click on the "certificate error" button in the URL bar, and import the certificate into the "trusted publishers" section
7. In Internet Explorer - Tools - Internet Options - Content - Certificates select "tusted publishers" tab
9. Select the imported certificate, press Export button and save as "Base-64 encoded X.50(.CER)" format
11. Start a command line window and navigate to SUM/jvm/jre/bin folder
13. Import the SSL certificate into the JVM keystore, cacerts file >keytool -import -alias T21 -file <path to .cer file> - keystore <path SUM/jvm/lib/security/cacerts> -storepass changeit

[Former Member]

Tried the steps mentioned above.. no luck!

[Former Member]

Hallo Mithun,

what O/S are you using? AIX? Is it this what you did??

1) Login as <sid>adm

2) setenv JAVA_HOME /usr/sap/<SID>/SUM/jvm/jre (or export JAVA_HOME=/usr/sap/<SID>/SUM/jvm/jre depending on the shell you are using)

3) The other steps from the note ....

Regards

Thomas.

[Former Member]

Yes..

The OS is AIX. followed all steps exactly.