Peer certificate rejected by ChainVerifier

[former_member223322]

Hi,

I am trying to connect a FTP server in secure mode and I am receiving the below error.

File processing failed with iaik.security.ssl.SSLCertificateException:

I have gone thru many threads in the forum and have made sure that my settings are fine. I am using the FTPS with control and data connection and X.509 checked. I have loaded the server certificate and private key in to Trusted CA and selected the same in my configuration. Now when I run the interface, I got the same error and my third party error says that the 'peer did not sent a certificate'. Could someone help me on this?

~Vaas

[former_member4985 · Accepted solution]

Hi Vaas,

The main reason for this error could be one of the following:

1. The correct server certificate could not be present in the TrustedCA

keystore view of NWA. Please ensure you have done all the steps

described in these two URLs:

Security Configuration at Message Level

http://help.sap.com/saphelp_nwpi71/helpdata/EN/ea/c91141e109ef6fe1000000

0a1550b0/frameset.htm

2. The server certificate chain contains expired certificate. Check for

it (that was the cause for other customers as well) and if it's the case

renew it or extend the validation.

3. Some other customers have reported similar problem and mainly the

problem was that the certificate chain was not in correct

order. Basically the server certificate chain should be in order

Own->Intermedite->Root. To explain in detail, if your server certificate

is A which is issued by an intermediate CA B and then B's certificate is

issued by the C which is the root CA (having a self signed certificate).

Then your certificate chain contains 3 elements A->B->C. So you need to

have the right order of certificate in the chain. If the order is B

first followed by A followed by C, then the IAIK library used by PI

cannot verify the server as trusted. Please generate the certificate in

the right order and then import this certificate in the TrustedCA

keystore view and try again. Please take this third steps as the

principal one.

As a resource, you may need to create a new SSL Server key.

The requirement from SAP SSL client side is that the requested site has

to have certificate with CN equal to the requested site. I mean if I

request URL X then the CN must be CN=X.

In other words, the CN of the certificate has to be equal to the URL in

the ftp request. This can be the IP address or the full name of the

host.

Request the url with the IP of the SSL Server and the certificate to be

with CN = IP of the server.

In any other case the SSL communication will not work.

Regards,

Caio Cagnani

[former_member223322 · Accepted solution]

Hi Caio,

We uploaded the certificates in the order as mentioned and also the CN in the certificate matches the server name that I have used in the channel configuration. But still I get the same error.

~Vaas

[former_member4985]

Hi Vaas,

It may be not part of a TrustedCA also.

And you can put the URL in the "hosts" file in your system

in order to test that.

Let us know

Regards,

Caio Cagnani

[Former Member]

Check whether the certificate is expired or not..

Regards,

TK

[former_member223322]

The certificate is valid.

~Vaas

[Former Member]

Hi,

take a look into this discussion, if not read yet. though its a lengthy thread its solved at the end.

regards,

francis

[former_member223322]

Hi Francis,

I have gone thru this thread already. But in my case I need to use the X.509 clinet authenticationn and this check will happen during the data connection step.

~Vaas