HTTPS activate error : Service could not be activated:SSL error(-14)

[Former Member]

Hi SDNer.

When I activate HTTPS service, received the error message as title.

I am looking for the error message in google. but I can't found acceptable answer.

what is "-14"?

Could you any hint for me?

Thank you.

Best Regards, John.

[Former Member · Accepted solution]

Hello Park,

have you activated the profile parameters for HTTPS

you have to activate parameters through RZ10 for activating HTTPS in AS ABAP

This should be the parameters

icm/server_port_1 = PROT=HTTPS, PORT=1443

Also make sure that parameter: icm/host_name_full = <hostname>.<dns> is also set

Refer to http://help.sap.com/saphelp_nw04s/helpdata/EN/56/2e453cabf4ef6fe10000000a114084/content.htm

for more detailed info,you would be able to start https service after setting this parameter.

Let me know of any issues

Rohit

[Former Member · Accepted solution]

Thanks Rohit Goyal,

My environment is :

SAP : SAP CE 7.1.1 (only Java)

OS : Windows 2003(64 bit)

DB : SAP DB

SID : CEM

I set the under parameters into CEM_J00_krst50077028 profile file located in "D:\usr\sap\CEM\SYS\profile".

-

---

1. Parameter values for SSL support

sec/libsapsecu = $(DIR_EXECUTABLE)\sapcrypto.dll

ssl/ssl_lib = $(DIR_EXECUTABLE)\sapcrypto.dll

1. Port definition

icm/server_port_4 = PROT=HTTPS, PORT=5$$01, VCLIENT=1

icm/host_name_full = krst50077028.abc.com

-

---

I activate the service in "http://krst50077028.abc.com:50000/sap/admin/public/default.html" > Core System > Active Services.

I received the error message as like "SSL error(-14)".

Thank you.

Regards, John.

[Former Member · Accepted solution]

hello Park,

Set the values as follows:

1. Parameter values for SSL support

sec/libsapsecu = $(DIR_EXECUTABLE)\sapcrypto.dll- for DIR_EXECUTABLE,give the full path where sapcrpto.dll file is located

ssl/ssl_lib = $(DIR_EXECUTABLE)\sapcrypto.dll- for DIR_EXECUTABLE,give the full path where sapcrpto.dll file is located

1. Port definition

icm/server_port_4 = PROT=HTTPS, PORT=5$$01, VCLIENT=1- PORT =50001

icm/host_name_full = krst50077028.abc.com

Make sure that sapcrpto.dll file is there in the filesystem

Rohit

[Former Member · Accepted solution]

Hi Rohit Goyal,

I changed the parameters accourding to your guide.

but the error continuesly appeared.

Under scripts which located in "http://krst50077028.abc.com:50000/sap/admin/public/default.html" > Core System > Parameters, is :

-

---

Parameter Settings

Services

icm/server_port_0 PROT=HTTP,PORT=50000,TIMEOUT=60,PROCTIMEOUT=600

icm/server_port_1 PROT=P4,PORT=50004

icm/server_port_2 PROT=IIOP, PORT=50007

icm/server_port_3 PROT=TELNET,PORT=50008,HOST=localhost

icm/server_port_4 PROT=HTTPS, PORT=50001, VCLIENT=1

HTTP(S) error handling

is/HTTP/show_server_header true

is/HTTP/show_detailed_errors TRUE

icm/HTTP/error_templ_path D:\usr\sap\CEM\J00\data\icmandir/error_templ

HTTPS (SSL) settings

icm/HTTPS/verify_client 1

icm/HTTPS/forward_ccert_as_header

icm/HTTPS/trust_client_with_issuer

icm/HTTPS/trust_client_with_subject

ssf/name

ssf/ssfapi_lib

sec/libsapsecu D:\usr\sap\CEM\J00\exe\sapcrypto.dll

ssl/ssl_lib D:\usr\sap\CEM\J00\exe\sapcrypto.dll

-

---

[Former Member · Accepted solution]

Hi Park,

Please remove the following parameters:

icm/server_port_1 PROT=P4,PORT=50004

icm/server_port_2 PROT=IIOP, PORT=50007

icm/server_port_3 PROT=TELNET,PORT=50008,HOST=localhost

HTTP(S) error handling

is/HTTP/show_server_header true

is/HTTP/show_detailed_errors TRUE

icm/HTTP/error_templ_path D:\usr\sap\CEM\J00\data\icmandir/error_templ

HTTPS (SSL) settings

icm/HTTPS/verify_client 1

icm/HTTPS/forward_ccert_as_header

icm/HTTPS/trust_client_with_issuer

icm/HTTPS/trust_client_with_subject

These are not needed

Rohit

[Former Member · Accepted solution]

Hi Rohit Goyal,

I saw the trace in web administration.

In trace log,

1) "D:\usr\sap\CEM\J00\sec\SAPSSLS.pse" is not exist. but the file is exist in the folder.

2) "D:\usr\sap\CEM\J00\sec\ticket" file is not exist in there.

[Thr 8876] =================================================

[Thr 8876] = SSL Initialization on PC with Windows NT

[Thr 8876] = (711_REL,Aug 5 2008,mt,ascii-uc,SAP_UC/size_t/void* = 16/64/64)

[Thr 8876] profile param "ssl/ssl_lib" = "D:\usr\sap\CEM\J00\exe\sapcrypto.dll"

[Thr 8876] resulting Filename = "D:\usr\sap\CEM\J00\exe\sapcrypto.dll"

[Thr 8876] = found SAPCRYPTOLIB 5.5.5C pl24 (Jun 11 2008) MT-safe

[Thr 8876] = current UserID: KRST50077028\SAPServiceCEM

[Thr 8876] = using SECUDIR=D:\usr\sap\CEM\J00\sec

[Thr 8876] *** ERROR => secudessl_Create_SSL_CTX(): PSE "D:\usr\sap\CEM\J00\sec\SAPSSLS.pse" not found! [ssslsecu.c 1354]

[Thr 8876] secudessl_Create_SSL_CTX: SSL_CTX_set_default_pse_by_name() failed --

[Thr 8876] secude_error 18946 (0x00004a02) = "Ticket error"

[Thr 8876] >> -

---

Begin of Secude-SSL Errorstack -

---

>>

[Thr 8876] ERROR in SSL_CTX_set_default_pse_by_name: (18946/0x4a02) Ticket error : "No License ticket file found (trying D:\usr\sap\CEM\J00\exe\ticket):

[Thr 8876] No License ticket file found (trying D:\usr\sap\CEM\J00\sec\ticket):

[Thr 8876] No License ticket file found (trying c:\secude\etc\ticket):

[Thr 8876] "

[Thr 8876] ERROR in ssl_set_pse: (18946/0x4a02) Ticket error : "No License ticket file found (trying D:\usr\sap\CEM\J00\exe\ticket):

[Thr 8876] No License ticket file found (trying D:\usr\sap\CEM\J00\sec\ticket):

[Thr 8876] No License ticket file found (trying c:\secude\etc\ticket):

[Thr 8876] "

[Thr 8876] ERROR in af_open: (18946/0x4a02) Ticket error : "No License ticket file found (trying D:\usr\sap\CEM\J00\exe\ticket):

[Thr 8876] No License ticket file found (trying D:\usr\sap\CEM\J00\sec\ticket):

[Thr 8876] No License ticket file found (trying c:\secude\etc\ticket):

[Thr 8876] "

[Thr 8876] ERROR in ??: (18946/0x4a02) Ticket error : "No License ticket file found (trying D:\usr\sap\CEM\J00\exe\ticket):

[Thr 8876] No License ticket file found (trying D:\usr\sap\CEM\J00\sec\ticket):

[Thr 8876] No License ticket file found (trying c:\secude\etc\ticket):

[Thr 8876] "

[Thr 8876] << -

---

End of Secude-SSL Errorstack -

---

[Thr 8876] *** ERROR => SapISSLAddCredential(): Error SSSLERR_PSE_ERROR trying to create SERVER Credential

for "D:\usr\sap\CEM\J00\sec\SAPSSLS.pse" [ssslxxi.c 2278]

[Thr 8876] Mon Apr 27 17:08:41 2009

[Thr 8876] *** ERROR => Initialization of SSL library failed -- NO SSL available!

[Thr 8876] =================================================

[Thr 8876]

[Thr 8876] <<- ERROR: SapSSLInit(read_profile=1)==SSSLERR_PSE_ERROR

[Thr 8876] *** ERROR => IcmServInitSSL: SapSSLInit (rc=-40): SSSLERR_PSE_ERROR [icxxserv.c 250]

[Thr 8876] *** WARNING => Could not start service 50001 for protocol HTTPS on host "krst50077028.abc.com"(on all adapters) [icxxman.c 4232]

[Former Member · Accepted solution]

Hello Park,

1. after putting the parameters,have you restarted your system?

2. It looks as it is not able to read the sapssls.pse file,I would suggest you to recreate the PSE

by using the following method:

http://help.sap.com/saphelp_nw04s/helpdata/en/a6/f19a3dc0d82453e10000000a114084/content.htm

Rohit

[Former Member · Accepted solution]

Also Park,

refer to the following link

http://developers.sun.com/docs/javacaps/configuring/jcapscfgsnetsap.ggrqn.html

It will be highly useful

Rohit

[Former Member · Accepted solution]

and one more thing Park,

change the following parameter value for https port:

icm/server_port_1 = PROT=HTTPS, PORT=1443

Rohit

[Former Member · Accepted solution]

Hi Rohit,

Thank you for your all help.

I recreated PSE file in nwa and copied the ticket file in sec folder and restarted ICM.

HTTPS service was started after restart.

Thank you.