ICM_HTTP_SSL_ERROR

[Former Member]

Hi

At ATD server (SAP WEB AS 6.40 ABAP+JAVA) we have installed the SSL certificate by using transaction (STRUST) which is issued by versign.com and issued to esp12.clpgroup.com

and it is valid only (07/05/2006 to 07/06/2007).

But when we are accessing the LAC application (placed at ATD) from SRM server (CPD) it is showing invalid certificate. Please see the attached document (HTTPS connection.doc).

Please let me know why it is showing invalid certificate, while accessing LAC application. is it necessary to install SSL certificate for j2EE engine also?.

while doing connection test from CPD to ATD we getting error (ICM_HTTP_SSL_ERROR).

Thanks and regards

Seshu

[WolfgangJanzen]

See also .

Regards, Wolfgang

[Former Member]

Hi Wolfgang,

Thanks!

One question is that we have installed SSL certificate at ATD server (ABAP+JAVA 6.40) using STRUST transaction, we have installed LAC (java component) on the same server on j2EE engine. When we are accing this application from SRM server by using secure connection it prompting ICM_HTTPS_SSL_ERROR and it showing invalid certificate (i.e issued to: local host and issued by: local host) actually the certificate what we installed (by using STRUST)at ATD server is issued by versign and it is valid only.

is it necessary to install SSL certificate for J2EE engine also on the same server(ATD) by using keystore service?.

if not can you please help me to solve this problem.

Thanks and regards

Seshu

[WolfgangJanzen]

Hi Seshu,

are you telling me that the SSL server certificate (of LAC) is issued to "CN=localhost" ...?!

Please help me to understand:

Is LAC an application deployed on the SAP J2EE engine or is it an additional server running side-by-side on the same machine where also the two SAP server stacks (ABAP and J2EE) are running? That would then sum up in 3 SSL servers.

Are the ABAP server and the SAP J2EE server using the same SSL server certificate (with identical key pair)? (=> did you perform an PKCS#12 export/import?)

Regards, Wolfgang

PS: anyone who knows more about "LAC" is invited to comment ...

[Former Member]

Hi Wolfgang,

Thanks!

Yes, The LAC application deployed on the j2ee engine. Two SAP server stacks are running (ABAP and J2EE), we have installed LAC on j2EE engine. We have installed SSL certificate on ABAP by using STRUST.

I havent perform PKCS#12 export import. Please let me know the step by step procedure to export and import.

Here one more problem is there that initially while installing SSL server certificate on ABAP, we have deviated the host name to hide the internal host name. But from SRM server we are calling LAC application with orginal host name, so then there is a chance to get error that host name not matching. so please let me know how to over come that problem.

Thanks and regards

Seshu

Thanks and regards

Seshu

[WolfgangJanzen]

Hi Seshu,

I assume that both (ABAP and J2EE server) are running on the same physical machine. In that case both could share the same SSL server certificate (which need to match the hostname).

The J2EE keystore supports PKCS#12 export/import.

The ABAP keystore management (transaction STRUST) unfortenately does not offer those features; you'll have to use a command line tool (sapgenpse):

- sapgenpse import_p12 -p <PSE filename> <filename>.p12

- sapgenpse export_p12 -p <PSE filename> <filename>.p12

If your server has the hostname "server.company.com" then the SSL server certificate should be issued to the subject "CN=server.company.com, O=company, C=country" (relevant is the CN section: it needs to be identical with the hostname used in the https URL to address the SSL server).

Cheers, Wolfgang

[Former Member]

Hi Wolf,

Thank you!

Request you to make me more clear, for the following questions.

1.sapgenpse import_p12 -p <PSE filename> <filename>.p12

2.sapgenpse export_p12 -p <PSE filename> <filename>.p12

in above 2 steps which one i have to perform first?. which PSE file i need to export and import (SAPSSLA.pse or SAPSSLS.pse)?. what wil be the <filename>.p12?.

In command propmpt can i follow below path to execute those commands.

usr\sap\<SID>\<instance>\sec\

Please asume orginal hostname of our server is DEV.vr.group.com, but we have installed SSL with the host name EVD.group.com by using STRUST. we have published external URL with the name EVD.group.com and at ISA server we have activated link translator to convert external URL to internal URL. Now for J2EE instance we are importing the same PSE but from SRM server we are calling LAC application with orginal host name, so please suggest me what should i do?.

Thanks and regards

Seshu

[WolfgangJanzen]

> in above 2 steps which one i have to perform first?.

> which PSE file i need to export and import

> (SAPSSLA.pse or SAPSSLS.pse)?. what wil be the

> <filename>.p12?.

Sorry, I did not provide a step-by-step instruction (and I did not intend to do so). I was only informing you on the functional capabilities of the command line tool. If you are familiar with PKCS#12 export/import that information should be sufficient to perform the required actions.

Well, wether you perform a PKCS#12 export of the PSE file (on the ABAP side) and then perform a PKCS#12 import to the J2EE keystore or vice versa depends on where you consider the "correct SSL server certificate" to currently reside. The aim of the game is: replace one by the other - to end up with only one (but with two identical copies)

On the ABAP side:

yes, usually SAPSSLS.pse is the filename of the "SAP SSL Server" PSE file.

> Please asume orginal hostname of our server is

> DEV.vr.group.com, but we have installed SSL with the

> host name EVD.group.com by using STRUST. we have

> published external URL with the name EVD.group.com

> and at ISA server we have activated link translator

> to convert external URL to internal URL. Now for J2EE

> instance we are importing the same PSE but from SRM

> server we are calling LAC application with orginal

> host name, so please suggest me what should i do?.

Well, as explained previously:

the hostname contained in the URL (used to adress the SSL server) needs to match the CN part of the subject name of the SSL server certificate.

So, if "https://EVD.group.com" is the URL, then the SSL server certificate should have a subject name which contains "CN=EVD.group.com" (the rest of the subject is not relevant for this SSL-hostname-matching-contraint).

Notice: the SSL/https client will check whether URL and certificate are matching.

Notice: The SSL server certificate might also be issued to "CN=*.group.com". That would also match the URL "https://EVD.group.com". Just that some Certification Authorities refuse to issue such generic SSL server certificates ...

Cheers, Wolfgang

[Former Member]

Hi Wolfgang,

Thank you!

Request you to clarify the following dought.

In the command prompt, where should i perform the following activity(sapgenpse export_p12 -p <PSE filename> <filename>.p12)?. what is the path i sould follow, to export from ABAP instance?.

can i follow below path?

<drive>;\usr\sap\SID\instance\sec\

and what is the path i should follow to perform the import activity that is (sapgenpse import_p12 -p <PSE filename> <filename>.p12) for java instance

And i have tried to export from above said path but it prompting error that no license ticket found,

I have tried like this <drive>:\usr\sap\<SID>\<Insance>\sec\ sapgenpse export_p12 -p SAPSSLS.pse xyz.p12

is this correct way to export..?

Please help me to solve this problem.

Thanks and regards

Seshu

[Former Member]

Hi Wolfgang,

Thanks!

I have exported the keypair from ABAP stack to the j2EE engine successfully.

Actually when i execute below command

f:>sapgenpse export_p12 -p SAPSSLS.pse mynew.p12

i have got "no logon ticket found". Then i run the following command

set SECUDIR= k:\usr\sap\<SID>\dvebmgs00\sec

then i successfully exported the certificate in to the "f" drive.

To import the keypair into J2EE engine, i have followed the below path

After i logon to Visula admin tool>keystorage>ssl-certificate> load>.p12 file from os level.

Thanks and regards

Seshu