Peer certificate Rejected city ChainVerifier

[Former Member]

Hello SAP experts

We must activate a FTPs adapter to a vendor. Vendor has sent us a self-signed

certificate

We have loaded the certificate in TrustedCAs

We have entered into the adapter:

Server: CN - found in the certificate

Port: 9990

Connection Security: FTPS (FTP Using SSL / TLS Control and Data Connection

Command Order: AUTH TLS, USER, PASS, PBSZ, PROT

No. X.509 selected

User and password from the vendor

Connect mode: Per File Transfer

Transfer Mode: Binary

From the supplier, we have received:

URLs: ftp:// <IP>: 9990 (AUTH SSL)

ftps:// <IP>: 9989 (Implied)

Port Range: 20995 to 21014

USER / PASSWORD

We can telnet from our side to the mentioned ports

We have not received a root and immediate Certificate

Vendor stated that they have other customer that uses this setup. However we donu2019t know if this is PI customers.

We have tested the SSL on our side with HTTPs.

We get the following error: Peer certificate Rejected city ChainVerifier

Has anyone had the same problem?

Best Regards

Erik

[Steven_UM]

As far as I know and experienced ... self-signed certificates without a root certificate are not supported by PI .

We always ask our external integration partners to use certificates from a proper CA.

Regards,

Steven

[Former Member]

Hi Erik,

I`ve spent some days struggling with the same issue. For testing purpouses we installed a Filezilla server with FTPS mode and it worked with a certificate generated by filezilla itself (self-signed). We did the same for the external FTPS server and failed because of certificate error. Finally we discover that if we were to use only FTPS for control connection it was working fine, it seems that the second time it tries to do the handshake for encrypting the file it fails. We supose that it happens because this second handshake is done using IP address instead of server name.

To sumarize:

In Local network ->

Installed filezilla server in a computer with server name, enable SSL, allow explicit mode, force PROT P. Generate certificate with server name instead of IP address using filezilla. Remove from generated certificate the private key. Import certificate in Visual administrator as TrustedCAs (7.0).

CC - server name, port 21, passive, FTPS control and data connection. Auth TLS, user, pass, pbsz, prot. OK

With external server->

Import certificate in VA. CC - server name, passive, FTPS control and data connection. Auth TLS, user, pass, pbsz, prot.

NOT OK, second handshake error

Don't force PROT P in FTPS server. CC - server name, port 21, passive, FTPS control connection. Auth TLS, user, pass, pbsz, prot. OK

To allow control and data connection encryption maybe is needed to set external name for FTPS server in server settings.

Hope this helps.

Iván.

[marksmyth]

Hello

Use the tracing tool attached to note #1514898 Diagtool for troubleshooting XI. This should give you a very good idea as to the exact cause of the problem.

Regards

Mark

[Former Member]

Error from diagtool:

Error during disconnect from ftp server as2.progrator.com, ignored: com.sap.aii.adapter.file.ftp.FTPEx: 550 Unexpected reply codeiaik.security.ssl.SSLException: Peer sent alert: Alert Fatal: bad certificate

10:40:42:154 J2EE_GUEST ~l_sender/FTPS_TEST/VANS]_54305 ~rverTrusted(X509Certificate[]) Failed to verify server certificate chain: no trust anchor found

[Former Member]

Have you restart R3 Instance, after certificate importing?

[Former Member]

Yes we have restarted the PI system after certificate import.

Best Regards

Erik

[Former Member]

Hi Erik,

I think this error occurs during the SSL session handshaking setup. This happens if IS is not able to verify the signature of the certificate of the 3rd party vendor. Pls check the root certificates again, they might not have been installed correctly.

One soultion is u can either ask the 3rd party FTP vendor to resend copies of the appropriate Root certificates. Also, if you can obtain their public key certificate, you can try to extract the Root certs from that.

System Restart is must after import.

Cheers,

Souvik

Edited by: Souvik Chatterjee on May 27, 2011 2:51 PM

[Former Member]

Yes, I agree.

Check also note 694290.

[Former Member]

We have not received a root certificate.

The supplier claims that they have never issued any root or Immediate Certificate, and others of their customers run FTPs without.

Can you configure XI without root certificate?

Best Regards

Erik

[Former Member]

This error usually occurs when PI can't authenticate himself on receiver side with root/server certificate. Then... maybe this is the cause.

[Former Member]

are all the ports from your end and the vendors end open to read/write access?

check if the connectivity ports are correctly opened. Even the vendor needs to grant acces to the ports from where u are accessing their server.

[Former Member]

We've tried using third party tool and conneted FTPs with no problems

This must show that we do not have firewall issues?

Best Regrds

Erik

[Former Member]

Yes, i don't believe that is a firewall issue (receiver server reply with Chain Verify error).

In FTPS configuration, have you set receiver hostname or ip?

[Former Member]

In FTPs configuration we have hostname which is the same as CN in certificate.

BR

Erik

[Former Member]

Well, I think that the only cause is that you need to trust destination server on PI, importing root CA.