Skip to Content
avatar image
Former Member

SSSLERR_SERVER_CERT_MISMATCH

Hi Experts,

I am currently on PI 7.0 SP09 and running on HA mode (2 servers). There have been some issues since a month ago. In SM59 when we try connection testing with customers (no specific ones), we would get both success and failure results randomly all day long, the error would be ICM_HTTP_TIMEOUT. I have increased ICM timeout to no avail, and i do believe the reason lies somewhere else.

Below is the error from dev_webdisp in Web Dispatcher:

[Thr 10] Mon Jun 15 21:51:33 2009

[Thr 10] MatchTargetName("DX102", "CN=TX624, OU=I0020241174, OU=SAP Web AS, O=SAP Trust Community, C=DE") FAILS

[Thr 10] SSL socket: local=10.23.1.15:47371 peer=10.23.2.19:44401

[Thr 10] <<- ERROR: SapSSLSessionStart(sssl_hdl=100fe6ce0)==SSSLERR_SERVER_CERT_MISMATCH

[Thr 10] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-30): SSSLERR_SERVER_CERT_MISMATCH [icxxconn_mt.c 2005]

[Thr 10] *** ERROR => IcmConnClientRqCreate() failed (rc=-14) [icrxx_mt.c 4885]

[Thr 10] *** ERROR => IcrIHandleHTTPClientRequest() failed -1 [icrxx_mt.c 2425]

TX624 is the CI while DX102 is the DI.

Appreciate any insights given.

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

2 Answers

  • avatar image
    Former Member
    Jun 15, 2009 at 03:12 PM

    To make things worse, now I cant even open Integration Repository and Directory.

    com.sun.deploy.net.FailedDownloadException: Unable to load resource: http://<server>:<port>/rep/repository/aii_ibrep_client.jar

    It was fine a few hours ago, all I did was a restart only.

    In fact, it has been fine since the day of Go Live years back.

    Calling out for help. Thank you in advance.

    Add comment
    10|10000 characters needed characters exceeded

  • avatar image
    Former Member
    Oct 16, 2009 at 07:56 PM

    Hello,

    We ran into a similar problem on our PI7.0 system after implementing some new features for inbound SSL. We added the SSL functions in STRUST and started getting this message in the ICM logs.

    My eventual solution was to change the name of the integration server in transaction SXMB_ADM to match the CN on our SSL certificate. I made other changes in the Exchange Profile and the instance profile to make the names match the CN. After getting the development system working again, we are moving onto the QA system. QA is working fine after implementing the changes to get the SSL certificate in place. QA does not have any of the changes to make the system name match the CN yet. The new PI changes have not been transported to QA. When the process goes into production, I will add an update as to what I discovered.

    Regards,

    Robert

    Add comment
    10|10000 characters needed characters exceeded