X.509 certificate authentication thru Webdispatcher error

[sam_venkat]

We have a setup as follows:

SOAP client ==> HTTPS ==> Web Dispatcher (Terminates SSL + Re-encrypts) ==> HTTPS ==> Backend PI7.1

The setup is based on help.sap.com topic "X.509-Based Logon to NW AS from SAP Web Dispatcher" for PI7.1. Even though the client forward parameter ( icm/HTTPS/forward_ccert_as_header = true) is set in Webdispatcher profile, it does not forward the certificate to the backend. Instead we get a basic authentication screen when we hit the webdispatcher URL. In the webdispatcher trace we see the below error. The webdisp is unable to add the cert to the HTTP header of the message going to the backend PI system.

Thr 2736] <<- SapSSLGetPeerInfo(sssl_hdl=00000000247CE840)==SAP_O_K

[Thr 2736] HttpModGetDefRules: Client certificate received: with

len=1773, subj="CN=xxxxxx", issuer="CN=xxxxx, O=xxxx, C=US",

cipher="SSL_RSA_WITH_RC4_128_SHA"

[Thr 2736] HttpModGetDefRules: determined actions: 20

[Thr 2736] <<- SapSSLGetPeerInfo2(sssl_hdl=00000000247CE840)==SAP_O_K

[Thr 2736] result = "#certs= 3, keysize= 128, cipher= 0005"

[Thr 2736] HttpModHandler: add cert to headers: cert_array_len=3,

cipher_id_len=2, cipher_size=128

[Thr 2736] *** ERROR => HttpModHandler: base64encode failed(26)

[http_rewrite 1535]

[Thr 2736] *** ERROR => HttpModHandler: base64encode failed(26)

[http_rewrite 1535]

[Thr 2736] *** ERROR => HttpModHandler: base64encode failed(26)

[http_rewrite 1535]

[Thr 2736] cipher_suite: 0005

[Thr 2736] HttpModHandler: perform the actions: 20

[Thr 2736] MPI<4>1#4 GetOutbuf -1 7e2160 65536 (0) -> 00000000041421D0

131072000 MPI_OK

[Former Member]

Hi,

Your problem is interesting but strange !

I've checked the doc and the OSS notes and did not find any clues.

The only thing I would do before opening an OSS message with SAP, is checking if the

cipher="SSL_RSA_WITH_RC4_128_SHA" is compatible with the sap crytolib.

It seems to be because in the log, the content of the client certificate looks to be decoded...

Have you tried to increase the trace level ?

Regards,

Olivier

[sam_venkat]

Yes, this is the max trace level. Webdisp sees the cert but the encode is where the issue is.