SSL SOAP Receiver: Peer certificate rejected by ChainVerifier

[former_member301120]

Hello to all,

we run on PI 7.1 and I want to consume a webservice with https.

I'va added the certificate in the key storage at NWA. I've add the certificate in view ICM_SSL_<NODE> and service_ssl.

But I get always the following error:

com.sap.engine.interfaces.messaging.api.exception.MessagingException: 
iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier

What's my fault

Please advice and ask for further information if needed

Regards Christian

[former_member4985]

Hello,

In general the causes could be:

1. The correct server certificate could not be present in the TrustedCA

keystore view of NWA. Please ensure you have done all the steps

described in these two URLs:

Security Configuration at Message Level

http://help.sap.com/saphelp_nwpi71/helpdata/EN/ea/c91141e109ef6fe1000000

0a1550b0/frameset.htm

2. The server certificate chain contains expired certificate. Check for

it (that was the cause for other customers as well) and if it's the case

renew it or extend the validation.

3. Some other customers have reported similar problem and mainly the

problem was that the certificate chain was not in correct

order. Basically the server certificate chain should be in order

Own->Intermedite->Root. To explain in detail, if your server certificate

is A which is issued by an intermediate CA B and then B's certificate is

issued by the C which is the root CA (having a self signed certificate).

Then your certificate chain contains 3 elements A->B->C. So you need to

have the right order of certificate in the chain. If the order is B

first followed by A followed by C, then the IAIK library used by PI

cannot verify the server as trusted. Please generate the certificate in

the right order and then import this certificate in the TrustedCA

keystore view and try again. Please take this third steps as the

principal one.

4. If the end point of the SOAP Call(Server) is configured to accept

a client certificate(mandatory), then make sure that it is configured

correctly in the SOAP channel and it is also within validity period.

(This certificate is the one which is sent to Server for Client

authentication)

As a resource, you may need to create a new SSL Server key.

The requirement from SAP SSL client side is that the requested site has

to have certificate with CN equal to the requested site. I mean if I

request URL X then the CN must be CN=X.

In other words, the CN of the certificate has to be equal to the URL in

the ftp request. This can be the IP address or the full name of the

host.

Request the url with the IP of the SSL Server and the certificate to be

with CN = IP of the server.

In any other case the SSL communication will not work.

Regards,

Caio Cagnani

[former_member301120]

Hello to all,

I solved the problem.

You need to import the public ssl - certificat in the j2ee secure store.

Change to nwa: Configuration Management -> Certificates and Keys

Content -> Trusted CA

Add here the public certificate and the ssl connection will work.

Regards Christian

[Former Member]

Hi Christian

Can you give me detailed information what you have done to solve the problem? What do you mean with "j2ee secure store", how can you import an certificate there?

Thanks

Christoph

[former_member301120]

Hello,

the J2EE secure store is found in the nwa.

Log on nwa then Configuration Management -> Certificates and Keys.

Regards

[Former Member]

check this thread for similar problem:-

chirag

[former_member301120]

Hello,

I read this guide already.

https is configured and enabled.

If I visit https://<server>:<https-port>; the server anwers and I get a trusted connection.

If I call the webservice I get the error above. I have alredy imported the public certificate of destination server in the key storage.