How to remove SSL client certificate caching on an SAP server?

[Former Member]

We have a secure HTTPS application that passes client-side SSL certificates to the server for authentication purposes.

The clients are iOS and Blackberry devices.

The first time the user connects, they are able to carry out their required actions and everything works fine.

If the client waits a short time (e.g. 2 minutes) and tries to perform another action, it looks like their user session tries to be resumed, so the client certificate tries to get loaded from the cache on the SAP server - this causes the certificate to not be found and the client authentication gets rejected.

This is the error from the SAP ICM Trace file:

[Thr 136] Thu Jan 17 10:51:46 2013
[Thr 136] <<- SapSSLSessionStart(sssl_hdl=000000001CB5F150)==SAP_O_K
[Thr 136] status = "resumed SSL session, NO client cert"

The application is stateless, so session ID's and session persistence should not be required.

Therefore, please can you tell me how I can force the client certificates to not be cached, but to be required on every new connection attempt?

[Former Member]

It's a limitation of the client, not of SAP. See SAP note 943248 for details. You could confirm the assumption by trying to reproduce the problem with a client capable of SSL session caching, such as Firefox.

You could try to see if increasing the keepalive setting in the ICM of your AS ABAP avoids the problem.

https://service.sap.com/sap/support/notes/943248

[Former Member]

Thanks for the helpful reply. We are still investigating. I'll update this message when we've resolved the issue.