Error while connecting to external system in SM59 with ICM_HTTP_SSL_ERROR

[Former Member]

Hi all,

we have configured an SM59 RFC destination of G type which pings to the external third party server. Before testing we have uploaded the external server certificate in PI system. it was working fine with * HTTP 200 OK* message. since 2 days we are facing the ICM_HTTP_SSL_ERROR while testing the connection. when we telnet from PI to the external system using the port no.443, its getting connected.

so any idea why it started giving the error.

We have check out this forums but of no help.

[ICM_HTTP_SSL_ERROR|;

The trace file dev_icm says

[Thr 52] Thu Jan 20 14:34:00 2011
[Thr 52] *** ERROR during SecudeSSL_SessionStart() from SSL_connect()==SSL_ERROR_CONNECTION_LOST
[Thr 52]    session uses PSE file "/usr/sap/XD1/DVEBMGS00/sec/SAPSSLDRV.pse"
[Thr 52] No Secude Error present in trace stack!
[Thr 52]   SSL_get_state() returned 0x00002141 "SSLv3 read server key exchange B"
[Thr 52]   SSL NI-sock: local=192.168.127.70:65243  peer=80.78.2.187:443
[Thr 52] <<- ERROR: SapSSLSessionStart(sssl_hdl=6000000000d50fd0)==SSSLERR_SSL_CONNECT
[Thr 52] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT {00370a03} [icxxconn_mt.c 1957]
[Thr 81] Thu Jan 20 14:34:15 2011
[Thr 81] IcmWorkerThread: end worker thread 53
[Thr 80] Thu Jan 20 14:44:45 2011
[Thr 80] IcmWorkerThread: end worker thread 52

Thanks,

Asem

[srikanth_srinivasan3]

Are you facing the issue only for this RFC destination or for all?

If for all, could you check the cryptographic libraries?

The last option is to check at the receiver side.

-

Srikanth Srinivasan

[RKothari]

Hello,

Please check the SAP Note 1094342 - ICM trace contains verification of the server's certificate.

-Rahul

[Former Member]

Hi Aseem,

Check SAP note: 1318906 - Trace analysis of SSL problems

and /people/dezso.pap/blog/2008/01/25/ads-ssl-configuration-journal-i-abap--java-640--70x

Thanks,

[Former Member]

Hareen,

We checked the the note 1318906 and followed the steps but error persists.

Could you please advice more on this.

Rahul,

The note you mentioned is for different error "ICM_HTTP_INTERNAL_ERROR".

Br

Asem

[RKothari]

Hello,

Yes, I have read it but the ICM trace you have mentioned is similar to note.

So, I thought it could be helpful to just have a look to it.

On what PI version is you environment????

-Rahul

[Former Member]

Check the expiry date of the certificate.

Thanks,

[Former Member]

Rahul,

We are using PI 7.1.

Hareen,

Certificate is valid till 2038.

Br

Asem

Edited by: Asem Singh on Jan 20, 2011 3:16 PM