File Adapter and X.509 client certificates

[Steven_UM]

Hi folks,

We are trying to set up a scenario with an external partner where we are sending content via FTPS to their server. We will log on to their system using X.509 client certificates.

We are having issues in getting this to work properly. Our system has been SSL enabled, a server certificate is installed, etc ...

We have configured the channel to use X.509 certificates and filled in the keystore and certificate reference.

When we try to connect then we get an SSL error ... When we look at the trace then an exception is occuring on the following code:

com.sap.aii.security.lib.net.ssl.impl.IAIKSSLContextInternalImpl#sap.com/com.sap.aii.af.app#com.sap.aii.security.lib.net.ssl.impl.IAIKSSLContextInternalImpl.getClientCredentials(Principal[], byte[], PublicKey)

#/Applications/ExchangeInfrastructure/Security#Plain###Could not retrieve key and cert to use for X.509 client authentication. Trying anonymous SSL connection.#

It seems that XI is not able to get the configured certificate out of its store ... and then just doens't present a client certificate ?

We have a couple of questions:

a) Can we use the public key of our server certificate as client certificate ? ( This is done all the time with other software ) ... Or do we need to generate a specific client certificate ...

b) The description on the communication channel says: "X.509 Certificate and Private Key" - it sounds like you need to configure 2 values here but via the dropdown list only one can be selected ... I am just asking as we tried it obviously with only 1 value and that didn't work.

c) Do we need to use a specific key store and/or are special authorizations needed by any kind of internal XI user to access the store ? For the moment our server certificate is sitting in the store 'service_ssl'

Thanks,

Steven

[Former Member]

Hi Steven,

this post seems a bit old but we are getting the same error you had before. How did you actually resolve it?

[Steven_UM]

Hi Bai,

This posting was indeed ages ago ... an error on SAP XI ...

Hmmm trying to remember ... don't know exactly anymore but I recall we had some issues with the authorisations of the XI service user on accessing the key store ...

Steven

[Former Member]

Hi Steven and Bai,

I'm getting the same error as well on PI 7.4. Do you remember which user you altered or other steps taken to solve this issue?

Iddo

[Former Member]

i think we re-start the ssl provider java service. it worked.

[nipun_shedhani4]

Hi Iddo,

If the Service restart does not help then you may need to check for your certificate and confirm

• if its in X.509 format and have extension .cer
• Also check for the keystore necessary permissions on the certificates so that the certificate is accesible by the adapter.
• If you do above changes, it would be a better if you restart the certificate service.

Regards,

Nipun

[Former Member]

Thanks Bai and Nipun,

The certificate is in X.509 format. I have another thread which deals with this issue: http://scn.sap.com/message/14361878 More details can be found there. I also restarted the whole system several times, no luck.

I am however curious about the permissions which are needed. How can I check that?

Iddo