unable to find valid certification path to requested target

[Bhargavakrishna]

Hi Experts,

We are working on Sales order replication scenario using SOAP protocol with "Basic authentication", please refer the below interface flow for your reference.

SAP C4C -----> SAP CPI ----> SAP Cloud connector --> SAP ERP (On-premise)

when we were testing the interface, we got the below error in SAP CPI.

org.apache.cxf.interceptor.Fault: Could not send Message., cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Message Processing Log:
StartTime = Fri Jan 26 17:07:43.828 UTC 2018
StopTime = Fri Jan 26 17:07:44.147 UTC 2018
OverallStatus = FAILED
ChildCount = 0
ChildrenCounter = 13
ContextName = com.sap.scenarios.cod2erp.querysalesorder.request
CorrelationId = AFprYF__NNPaDB_Rn2G4kGIZseET
IntermediateError = true
LastError = org.apache.cxf.interceptor.Fault: Could not send Message., cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
LastErrorModelStepId= MessageFlow_2
MessageGuid = AFprYF9mvtxVN5shOzs4KKtFWorG
Node = vsa3633010
ReceiverId = ERP_
SenderId = COD_
ReceiverIds [
ERP_
]

Branch:
Invoked endpoint:
StartTime = Fri Jan 26 17:07:43.828 UTC 2018
ChildCount = 1
Cxf.EndpointAddress = /COD/ERP/SALESORDER_REQUEST

Entering Camel route Process_1:
StartTime = Fri Jan 26 17:07:43.833 UTC 2018
ChildCount = 2
ModelStepId = MessageFlow_1

Exchange ID-vsa3633010-44092-1516463472798-57-4 created in Endpoint[cxf://bean:COD_]:
StartTime = Fri Jan 26 17:07:43.836 UTC 2018
Status = PROCESSING
ChildCount = 3
ModelStepId = MessageFlow_1

Processing exchange ID-vsa3633010-44092-1516463472798-57-4 in sap-pp-util://sender:
StartTime = Fri Jan 26 17:07:43.836 UTC 2018
StopTime = Fri Jan 26 17:07:43.838 UTC 2018
ChildCount = 4
ModelStepId = MessageFlow_1
StepId = to162

Processing exchange ID-vsa3633010-44092-1516463472798-57-4 in removeHeaders[*]:
StartTime = Fri Jan 26 17:07:43.838 UTC 2018
StopTime = Fri Jan 26 17:07:43.839 UTC 2018
ChildCount = 5
ModelStepId = MessageFlow_1
StepId = removeHeaders66

Processing exchange ID-vsa3633010-44092-1516463472798-57-4 in removeHeader[operationName]:
StartTime = Fri Jan 26 17:07:43.839 UTC 2018
StopTime = Fri Jan 26 17:07:43.840 UTC 2018
ChildCount = 6
ModelStepId = MessageFlow_1
StepId = removeHeader87

Processing exchange ID-vsa3633010-44092-1516463472798-57-4 in removeHeader[operationNamespace]:
StartTime = Fri Jan 26 17:07:43.840 UTC 2018
StopTime = Fri Jan 26 17:07:43.841 UTC 2018
ChildCount = 7
ModelStepId = MessageFlow_1
StepId = removeHeader88

Processing exchange ID-vsa3633010-44092-1516463472798-57-4 in cxf:bean:ERP_:
StartTime = Fri Jan 26 17:07:43.841 UTC 2018
StopTime = Fri Jan 26 17:07:44.145 UTC 2018
ChildCount = 8
Error = org.apache.cxf.interceptor.Fault: Could not send Message., cause: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
ErrorFaultCode = {http://cxf.apache.org/faultcode}server
HTTPRequestHeaders = Accept: */*
SAP_MessageProcessingLogID: AFprYF9mvtxVN5shOzs4KKtFWorG
SAP_MplCorrelationId: AFprYF__NNPaDB_Rn2G4kGIZseET
SAP_PregeneratedMplId: AFprYF88-TAJ_FSFfJNk_RihtSlY
SOAPAction: ""
HTTPStatusCode = 500
ModelStepId = MessageFlow_2

I referred couple of threads which is related to this issue and i got to know that, we need to deploy HCI certificates under TrustedCA's in SAP cloud connector. Is it mandatory to do this activity? because we are using basic authentication.

Can someone help me to list the activities needs to be done @ each application. I mean in SAP CPI, SAP cloud connector for this integration.

Thanks in advance.

Regards

Bhargava Krishna

[Sriprasadsbhat · Accepted solution]

Hello Bhargav,

Below KBAs will help you with exact action you need to perform.

2354153 - SunCertPathBuilderException in SAP Cloud Platform Integration message processing

2514375 - Unable to find valid certification path to requested target in HCI

Regards,

Sriprasad Shivaram Bhat

[Bhargavakrishna · Accepted solution]

Hi Sriprasad,

Thank you very much for the prompt response.

I have gone through suggested notes and could see we need to have receiver(SAP ERP) system root CA of server certificates in SAP CPI key store.

As i mentioned earlier, we are just using basic authentication, is this activity still mandatory?

Regards

Bhargava Krishna

[Sriprasadsbhat · Accepted solution]

Hello Bhargava,

As per mu understanding yes this is still mandatory to exchange the root certificates since the check happens at Load balancer level .

Regards,

Sriprasad Shivaram Bhat

[Bhargavakrishna · Accepted solution]

Hi Sivaram,

Thanks for the information.

We will deploy the certificates in key store and keep you posted on the results.

Regards

Bhargava Krishna