Skip to Content
avatar image
Former Member

SSLCertificateException: Peer certificate rejected by ChainVerifier. advise

Dear All Experts,

Need your help to resolve the below issue.

Our Client receiving the below error while sending the data from their Xi server.

"Delivering the message to the application using connection SOAP_http://sap.com/xi/XI/System failed, due to: com.sap.engine.interfaces.messaging.api.exception.MessagingException: iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier."

Pls find the below few details which will help to analyze the issue.

1> Our XI server is on PI 7.0 and their XI ( Client ) server is on PI 7.1

2> We are able to send the data successfully from our XI server to Client XI server on HTTPS without configuration of any certificates.

3> On the same way client XI server is failed to send the data to our XI server and returning above error.

4> Our XI server is on Windows and Client XI server is on Unix.

5> We are using the SOAP channel to exchange the messages.

Even we have exchanged the certificates to each other and configured the same from both the ends but still issue remains same without any change. Showstopper for us. Kindly advise.

Pls suggest to resolve the issue. Will help if we get any steps on the configuration part for HTTPS connectivity on XI 7.0 as well as on XI 7.1

Thanks & Regards

Machindra Patade

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

1 Answer

  • Jun 09, 2010 at 08:45 PM

    Hi Machindra,

    Basically, the main reasons because of which the error mentioned here

    are the following:

    1. The correct server certificate is not present in the TrustedCA

    keystore view of NWA .

    Please ensure you have done all the steps described in these two urls:

    Security Configuration at Message Level

    http://help.sap.com/saphelp_nwpi711/helpdata/en/48/d1c7e690d75430e100000

    00a42189b/frameset.htm

    2. The server certificate chain contains expired certificate. Check for

    it (that was the cause for other customers as well) and if it's the case

    renew it or extend the validation.

    3. Some other customers have reported similar problem and mainly the

    problem was that the certificate chain was not in correct

    order. Basically the server certificate chain should be in order

    Own->Intermedite->Root. To explain in detail, if your server certificate

    is A which is issued by an intermediate CA B and then B's certificate is

    issued by the C which is the root CA (having a self signed certificate).

    Then your certificate chain contains 3 elements A->B->C. So you need to

    have the right order of certificate in the chain. If the order is B

    first followed by A followed by C, then the IAIK library used by PI

    cannot verify the server as trusted. Please generate the certificate in

    the right order and then import this certificate in the TrustedCA

    keystore view and try again.

    4. If the end point of the SOAP Call(Server) is configured to accept

    a client certificate(mandatory), then make sure that it is configured

    correctly in the SOAP channel and it is also within validity period.

    (This certificate is the one which is sent to Server for Client

    authentication)

    Last, for the PI 7.1, please check:

    #1438515 - Development Configuration Import fails because CMS uses SSL

    Hope it helps.

    Regards,

    Caio Cagnani

    Add comment
    10|10000 characters needed characters exceeded

    • Former Member

      Dear All,

      The issue got resolved after installing the fresh certificates in ABAP ( STRUST ) .

      Thanks for your advise.

      Regards

      Machindra Patade