C4C-HCI-Cloud Connector-ERP integration certificate problem

[former_member423249]

Dear Experts;

we're facing the problem while integrating the C4C-HCI-ERP.

According the scenario, the data must be sent from C4C to ERP via HCI with cloud connector.

the error detail is,

Inbound processing in endpoint at /COD/ERP/BP_MASTER_REPLICATION failed with message "Fault:Sequential processing failed for number 0. Exchange[ID-vsa5094313-53714-1542797305052-2-16]. Caused by: [org.apache.cxf.interceptor.Fault - Could not send Message.]", caused by "SunCertPathBuilderException:unable to find valid certification path to requested target"

I'm really stuck and help neded in here, I really don't know what I'm missing. The steps I followed are,

1) for C4C-HCI connection I added the c4c certificate(which I downloaded it from C4C communication aggrement outbound ) to HCI keystore and also in the artifact import the c4c certificate to COD sender configuration. (in the pic c4c-hci 1. pic)

2) Cloud Connector -ERP connection (2. pic)On the cloud to onpremise tab I added the mapping (in the pic cloudconnector) which is reachable.

3) HCI-ERP connection (3. pic)I added the HCI chain certificate to strust (in the pic HCI-ERP2)and also I added the ERP client certificate to HCI keystore.

Last step, I configured the artifact receiver like in the pic (HCI_ERP) proxy is internet and the auth is none and deployed it.

I just want to send the data only c4c to erp not other way around. So is there any thing to do? by the way ERP is s/4hana onpremise

Should I add the erp or Hci certificate to Cloud connector if it's yes how can I do that. Because when I try to add CA certificate to Cloud connector it gives me an error like "Generate a certificate request first" . So I really stuck in here. any help really appreciated.

Thanks in advance.

[former_member423249]

Hello Vitor;

First of all I really thank for your quick response and link that you sent me I followed that but,

Actually I added the SAP server certificate to HCI keystore. Can you please check from pictures did I install the right certificates.

I installed from strust SSL server standart and import it to HCI keystore. Am I missing something?

Do I have to add any certificate to Cloud connector? Actually I'm not sure cloud connector side, I did not add any certificate into cloud connector.

Thanks in advance.

[vitor_lemberck]

Hello Buket,

There are five possible causes for this error message: The HCI tenant does not trust the receiver system's public certificate. For communication the "Internet" proxy type is used but the called server is not registered on the Internet. Since the outbound proxy of the SAP Cloud Platform automatically generates a certificate, instead of an UnknownHostException the SunCertPathBuilderException is thrown. HCI keystore does not have the server certificate of the SAP WD The host is reachable, but the CPI key store does not contain the root CA certificate of the server’s certificate.

In this case you need to add this certificate to the CPI keystore, please follow KBA 2715005 - Add SSL/TLS Certificates from a Website into the Key Store Monitor in CPI. The host is not reachable. In that case Cloud platform will redirect the request to some generic host. This fake host will have a generated SSL certificate, that is not trusted (which is the right thing to do). To distinguish between these issues you could use the TLS connectivity test in CPI.

When you do a normal test without setting any other parameters than the host and port, you should get the same error as in the channel. Then you can disable the server certificate validation. The test will probably succeed then and you can have a look into the server certificate chain. If you got the correct certificate chain, you can reach the server and can find out what the root certificate of the certificate chain is (the root certificate may or may not be part of the certificate chain).

Please check the SAP KBA https://launchpad.support.sap.com/#/notes/2514375 for resolution.