Setup SSL on ABAP : the issuer certificate is unknown

[Farid]

Hello,

I've been asked to set up the SSL on SAP 6.20 web applications servers (4.7).

I've carefully followed the instructions given in sap note 510007 : sapcryptolib installed, parametres configured, SSL server PSE configured, etc ..

Now, we have to create a certificate request and send it to our CA.

But, before to do that I wanted to test SSL server.

I found in the sapmarketplace that you can request a SSL Test Server Certificates, apparently it works exactly like the "real" SSL Server Certificates exept that it is temporary ( 8 weeks).

Therefore, I've generated the certificate request, sent it to sap trust certificate center, and imported the certificate response into the PSE, exactly as described in sap documentation.

Then I've established the trust relashionship necessary when using the SSL server PSE, I mean that I've imported the CA root certificate that the server should trust : TC TrustCenter Class 2 CA

Then I have inserted it into the server PSE's certificate list. In the end, I've restarted the ICM.

I wanted to test the SSL feature by sending https requests to the WAS but I got the following error (firefox):

******************************:1443 uses an invalid security certificate.

The certificate is not trusted because the issuer certificate is unknown.

(Error code: sec_error_unknown_issuer)

Unknown identity, certificate is not trusted because it hasn't been verified by a recognized authority

As you can imagine, I checked the certificate authorities in the browser, and TC TrustCenter Class 2 CA exists ... so I really do not underdtand where does the error come from ? Maybe from the TEST server certificate ?

I encounter the same behaviour with IE7.

Thank you in advance for your help.

Best regards.

Raoul.

Edited by: Raoul Shiro on Mar 30, 2009 8:58 PM

[former_member402999]

Hi Raoul,

the SSL Test Server Certificates are issued from the SAP Server CA. You need to install the root certificate of the SAP Server CA in your browser. You can download this root certificate from [http://service.sap.com/tcs] -> Download Area -> Root Certificates.

Best regards,

Klaus

[Farid]

Thanks Klaus

[Former Member]

Hi,

I am curious if it works now for you?

Does anybody know if the procedure mentioned here works on WAS 7.0 (ERP 6.0)?

Thanks,

[Former Member]

Hi,

>Does anybody know if the procedure mentioned here works on WAS 7.0 (ERP 6.0)?

Yes, the procedure is exactly the same with WAS Abap 7.0.

Regards,

Olivier