SOAP:call failed:iaik.security.ssl.SSLCertificateException:Peer certificate

[SanjayChavan]

We are getting following error in SOAP receiver channel :

SOAP: call failed: iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier.

Please note the following points:

a. We are not using SSL so far. We are connecting to a http(s) url but

without SSL.

b. However we do not choose certificate authentication in the CC

c. The receiver also not enabled certificate authentication at his end

Please suggest.

[former_member4985]

HI Sanjay,

Here is an explanation that may help you:

-> The client send request with certificate to PI which terminate at

first on ISA server and from there to PI with SSL.

-> What is ISA. If this is an intermediate server which terminates the

SSL connection, it should forward the SSL data with the certificate in

the request headers. But for this purpose the ICM settings should be

adjusted.

And:

If you have a direct connection to ICM without intermediate which

terminates the SSL (then the SSL is terminated by the ICM) and if the

client thinks that he sends a certificate but although an error is

thrown, then this shows a problem.

If you have a direct conenction to the ICM and the certificate is not

sent in the SSL connection is normal this error to be thrown - this is

not a problem.

If there is an intermediate which terminates and this error is shown -

there is a problem, but with the configuration. The log severity of

location com.sap.engine.services.httpserver.server.SslAttributes should

be increased and the problem reproduced.

Also I got the information that this behaviour has been fixed in 710

SP7 Patch level 13.

Please take a look at SAP Note 1278145.

You may also take in account note 856597, point 5.

Regards,

Caio

Edited by: Caio Cagnani on May 12, 2010 10:43 PM

[Former Member]

Hi,

check HTTPS service is running on PI.

SMICM -> Goto -> Services

If not, get in touch with your basis team installing the SAPcrypto lib.

Cheers,

André

[Former Member]

do the above ... however was this working before? your message sounds like it was working and it stopped.