ICM SSL and signing using MS Certificate Server

[Former Member]

Hello,

I've been searching for hours on end on this issue, and have not yet come accross a clear explanation on how to do it, or how to solve it.

When configuring HTTPS for ICM I'm having an issue with certificates signed by our internal Certificate authority.

When I create a default (unsigned) certificate, the links work correctly, and we receive a certificate exception (which is normal). Now, to avoid this exception, we would like to have it signed using our internal CA. The pages being vewed are for internal use only, which is why we do not want to pay for a certificate.

When using the signed certificate and going to the same HTTPS link as before, the web page no longer works (I think it's due to the wrong CN in the certificate).

I gather this is due to having a wrong FQDN (in the CN), but I'm unsure on how to change this.

This is what I do.

In STRUST, I generate a ticket (SSL Server Standard -> Create)

I fill in the requirements (so for CN --> *.domainname.extension) and then generate the certiicate (so CN now has hostname.domainname.extension).

When I use https (port 443), everything works. I receive the "Certificate not trusted" warning.

However, we want to get rid of this warning, which is why we're signing the certificate using the Microsoft Certificate Server.

This is how I do it:

In STRUST I click on the certificate and choose "Generate certificate request"

I then log onto the certificate server with user SAPService<SID> (I'm not even sure if I'm supposed to login with that user ID, but it seems logical to me).

I then goto:

- Request a certificate (--> Next)

- Advanced Request (--> Next)

- Submit a certificate request using a base64 encoded PKCS #10 file or a renewal request using a base64 encoded PKCS #7 file (--> Next)

- Paste my certificate request into the text box provided (--> Sumit)

I'm then presented with a certificate response file (choose base64 -> save onto Desktop -> Open certificate with notepad, copy the certificate response).

go back to SAP system --> STRUST

Then i click on "Import Cert. Response" and paste the response code into the textbox.

NOW... the 'normal' certificate changes (CN and everything changes --> CN is now the FQDN of the certificate server.. oddly enough).

Now, after restarting ICM, I try the HTTPS url again.. and I cannot even connect to the page anymore (hostname not known).. which is probably because of the wrong CN hostname in the certificate in STRUST.

I'm a bit baffled here.. I'm not sure how to change this CN= stuff. And I'm not even sure why the certificate response is actually changing my certificate.

Any help would be appreciated.

Also, the ICM logs don't really show me any useful information (I'm on trace level 3).

Thanks in advance.

Kind regards,

Ryan.

[Former Member]

Hi,

I am also using an internal PKI to sign my ICM SSL certificates and it works perfectly.

When you get the signed certificate (CER ? CSR ? P7B file ?) try to open it from a windows PC by double clicking it.

Check if the CN. If it is not the ICM server CN then the problem is with your PKI.

In STRUST be sure to import the complete certification chain with the CA certificates.

The easiest way I found is to import a base64 encoded P7B file. One click to import the p7b file in strust and it's done.

Regards,

Olivier

[Former Member]

Hello Olivier,

Thank you for your explanation.

However, it is unclear what the actual CN is. The only reference to CN I can see is in the "Issuer" field => CN=CERT_server.

And the certificate is issued to SAPService<SID>.

Maybe a far fetched question, but would you know of any guide which explains exactly how to sign your own certificate for use on SAP? In our PKI, the only option I have is to generate a user certificate (which is why the certificate is issued to SAPService<SID>).

Unfortunately, our Windows guys don't know the solution either (or just don't have the time... I don't know).

So, I'm wondering, is it the type of certificate I'm asking? I'm guessing a user certificate is not exactly what I need (issued to SAPService<SID>) but maybe I'd need a server certificate?

What kind of certificate did you request from your PKI when signing?

Thanks in advance.

Kind regards,

Ryan.

[Former Member]

Hi,

Yes the problem is that your internal PKI is only setup to generate user client certificates.

These are usually used for user authentication and email signatures and are NOT suited for an SSL server certificate.

Your PKI guys need to learn their product and to configure it to be able to sign decentralised SSL server certificates.

It is very strange that it is not already done because this one of the 2 most basic usages of a PKI...

The documentation to read is the MS certificate one, not a SAP one.

Regards,

Olivier