Unable to start SAPwebdispatcher using https SSL(termination)

[Private_Member_87402]

Hi

Please note that we are trying to configure https for SAP webdispatcher.

We are implementing SSL termination.

We are currently facing the following issue when we try to start the SAP webdispatcher.

E:\usr\sap\WD1\SYS\exe\nuc\NTI386\sec>sapwebdisp.exe pf=E:\usr\sap\WD1\SYS\exe\nuc\NTI386\sec\sapwebdisp.pfl

• WARNING: Could not start service 81 for protocol HTTPS on host "sapwebdisp1"

(on all adapters)

• SAP Web Dispatcher up and operational (pid: 6028) ***

The sapwebdisp.exe pf=E:\usr\sap\WD1\SYS\exe\nuc\NTI386\sec -checkconfig produces the below result

E:\usr\sap\WD1\SYS\exe\nuc\NTI386\sec>sapwebdisp.exe pf=E:\usr\sap\WD1\SYS\exe\nuc\NTI386\sec\sapwebdisp.pfl -checkconfig

Checking SAP Web Dispatcher Configuration

=========================================

maximum number of sockets supported on this host: 32768

Server info will be retrieved from host: sapmqa1:8101 with protocol: http

Checking connection to message server...OK

Retrieving server info from message server...OK

Message Server instance list:

----

---

--

---

+

---

+--

---

+

instance name

hostname

HTTP port

HTTPS port

----

---

--

---

+

---

+--

---

+

J2EE3794700

SAPMQA1

50000

----

---

--

---

+

---

+--

---

+

Checking ABAP servers with URL "/sap/public/icman/ping":

no server group "!DIAG" defined

Checking J2EE servers with URL "/index.html":

Checking J2EE server SAPMQA1:50000...ERROR: unexpected OK code: 404

ERROR: check if application is deployed and active

Check ended with 1 errors, 0 warnings

We are able to access the SAP webserver from the SAP webdispatcher through the URL

http://SAPMQA1:50000 which opens up the webserver page.

The dev_webdisp entries are as follows:

-

---

trc file: "dev_webdisp", trc level: 1, release: "700"

-

---

sysno 00

sid

systemid 560 (PC with Windows NT)

relno 7000

patchlevel 0

patchno 49

intno 20050900

make: multithreaded, ASCII, optimized

pid 6028

[Thr 6084] started security log to file dev_icm_sec

[Thr 6084] SAP Web Dispatcher running on: sapwebdisp1

[Thr 6084] MtxInit: 30001 0 2

[Thr 6084] IcmInit: listening to admin port: 65000

[Thr 5092] *** WARNING => HttpPlugInInit: Parameter icm/trust_client_with_issuer or icm/trust_client_with_subject not set => do not trust any intermediary

X.509 cert data will be removed from header [http_plgrt.c 670]

[Thr 5092] HttpExtractArchive: extract archive ./wdispadmin.SAR to .

SAPCAR: processing archive ./wdispadmin.SAR (version 2.01)

SAPCAR: 92 file(s) extracted

[Thr 5092] Tue Nov 09 15:27:08 2010

[Thr 5092] HttpExtractArchive: archive ./wdispadmin.SAR extracted to .

[Thr 5092] HttpSubHandlerAdd: Added handler HttpAdminHandler(slot=0, flags=4101) for /sap/wdisp/admin:0

[Thr 5092] CsiInit(): Initializing the Content Scan Interface

[Thr 5092] PC with Windows NT (mt,ascii,SAP_CHAR/size_t/void* = 8/32/32)

[Thr 5092] CsiInit(): CSA_LIB = ".\sapcsa.dll"

[Thr 5092] HttpSubHandlerAdd: Added handler HttpAuthHandler(slot=1, flags=12293) for /:0

[Thr 5092] HttpSubHandlerAdd: Added handler HttpWebDispHandler(slot=2, flags=28677) for /:0

[Thr 5092] Started service 81 for protocol HTTP on host "sapwebdisp1"(on all adapters) (processing timeout=60, keep_alive_timeout=30)

[Thr 5092] *** ERROR => IcmAddService: service 81 already exists [icxxserv.c 297]

[Thr 6084] IcmCreateWorkerThreads: created worker thread 0

[Thr 6084] IcmCreateWorkerThreads: created worker thread 1

[Thr 6084] IcmCreateWorkerThreads: created worker thread 2

[Thr 6084] IcmCreateWorkerThreads: created worker thread 3

[Thr 6084] IcmCreateWorkerThreads: created worker thread 4

[Thr 6084] IcmCreateWorkerThreads: created worker thread 5

[Thr 6084] IcmCreateWorkerThreads: created worker thread 6

[Thr 6084] IcmCreateWorkerThreads: created worker thread 7

[Thr 6084] IcmCreateWorkerThreads: created worker thread 8

[Thr 6084] IcmCreateWorkerThreads: created worker thread 9

[Thr 328] IcmWatchDogThread: watchdog started

[Thr 1056] Tue Nov 09 15:28:34 2010

[TomCenens]

Hello Renny

Looks like you already have a protocol running on port 81 as indicated by error message:

Thr 5092 *** ERROR => IcmAddService: service 81 already exists http://icxxserv.c 297

Can you post your parameter settings for the different icm/server_port_<number> you have defined in your backend system ?

Kind regards

Tom

[Private_Member_87402]

Hi Tom,

Please note that i am using the SAPwebdispatcher for SSL termination.

In the backend system, the parameter settings are as follows:

icm/server_port_2 PROT=HTTPS,PORT=8101

icm/server_port_0 PROT=HTTP,PORT=8000

ms/server_port_0 PROT=HTTPS, PORT=8100

Thank you

[former_member227283]

Hi,

Any reason why you are using port 81 for HTTPS??

Can you tell us how , you have installed webdispatcher i.e by using SAPINST or using SAPWEBDISP binary.

Thanks

Anil

[michael_mulvey]

Hi,

This is exactly the issue. There is a port conflict with port 81.

P.S. Is this a dual stack SAP system. If it is you need to enter the hostname and port of the ABAP system !

Michael

[Private_Member_87402]

Hi Michael,

Yes, this is a dual stack system.

Where do i enter the hostname and port of the ABAP system?

Thank you

[former_member227283]

Hi Renny,

ms/server_port_0 PROT=HTTPS, PORT=8100

Above parameter is not required in webdispatcher.

Pls paste all the value present profile file of webidpstacher in forum.

It will help us to resolve your problem.

Thanks

Anil

[michael_mulvey]

Hi Renny,

You have 3 issues which I will help with below:-

ISSUE 1

icm/server_port_2 PROT=HTTPS,PORT=8101

icm/server_port_0 PROT=HTTP,PORT=8000

ms/server_port_0 PROT=HTTPS, PORT=8100

This is incorrect. They should be set like this.

ms/server_port_0 PROT=HTTPS, PORT=8100

icm/server_port_0 PROT=HTTP,PORT=8000

icm/server_port_1 PROT=HTTPS,PORT=8101 <---- Note the 1 and not 2

The reason for this is if there is a number break in the sapwebdisp.pfl then the webdispatcher will not "read" the parameter. It HAS to be set 0, 1, 2, 3 etc for correct parsing of the parameter.

ISSUE 2

Error message no server group "!DIAG" defined

You need to have these three services active in transaction SICF:-

(1) /sap/public/icf_info/icr_groups

(2) /sap/public/icf_info/icr_urlprefix

(3) /sap/public/ping

ISSUE 3

As this system is a dual stack then you need to enter the hostname and http listening port of the ABAP message server, not java as you have already entered.

Please goto transaction SMMS -> Goto -> Parameters -> Display on the backend server and note the following parameters:-

(1) ms/server_port_0

(2) server host (fqn)

You will then have to enter this information into the sapwebdisp.pfl profile in the same directory as the webdispatcher executable.

(1) ms/http_port

(2) rdisp/mshost

And restart the webdispatcher. You can then check with -checkconfig switch that the message server is accessible and that your requests are being correctly routed.

Michael