Importing external web service with SSL certificate security

[Former Member]

Hello,

I'm trying to import an external web service (that resides in another server, independent of ours). However, right after I enter the WSDL in the import window I get the following error in the NWDS:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target      [Error: com.sap.ide.es.core.ui.internal.wizards.fragments  Thread[ModalContext,6,main]]

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

          at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)

          at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1649)

          at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)

          at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)

          at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)

          at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)

          at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

          at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

          at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

          at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

          at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)

          at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1149)

          at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)

          at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)

          at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1172)

          at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)

          at com.sap.ide.es.core.ui.internal.wizards.fragments.UrlValidationRunnable.getURLAsStream(UrlValidationRunnable.java:137)

          at com.sap.ide.es.core.ui.internal.wizards.fragments.UrlValidationRunnable.validate(UrlValidationRunnable.java:75)

          at com.sap.ide.es.core.ui.internal.wizards.fragments.UrlValidationRunnable.run(UrlValidationRunnable.java:55)

          at org.eclipse.jface.operation.ModalContext$ModalContextThread.run(ModalContext.java:121)

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323)

          at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217)

          at sun.security.validator.Validator.validate(Validator.java:218)

          at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)

          at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)

          at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)

          at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)

          ... 15 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

          at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)

          at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)

          at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318)

          ... 21 more

Has anyone ever consumed an external web service with SSL certificate security? How do you import this in your Web Dynpro project?

Cheers!

[Qualiture · Accepted solution]

Hi Alain,

I would save the WSDL on my local desktop and import into NWDS from there. This way you can still develop your model, CAF objects (if youre using CAF) etc.

In NWA, I would then create a new Destination Template pointing to the correct WSDL URL, and specify the authentication/certificate details here.

Hope this helps!

Robin

[Former Member · Accepted solution]

Hi Robin,

That's a great idea... let me try it and I'll get back to you to confirm it worked.

Thanks!

[Former Member · Accepted solution]

Hi Robin,

Importing a locally saved version of the WSDL does seems to work, at least for coding the application in my Developer Studio.

Right now, I'm trying to import and use the external Web Service in a CAF application. When I imported it, I created its Service Group. Now, after I deploy it, how can I configure this service group I created so that it can connect to the target server? I'm guessing I have to set it to use the certificate, but I'm not sure where?

I also tried to create a destination template for the CAF application, but when I try to map the destination with the CAF, the CAF application doesn't appear...

Thanks for your help with this!

[Qualiture · Accepted solution]

Hi Alain,

Although there may me different ways to achieve the desired results, I usually work the following way:

• In the CAF DC, under 'external' I import the WSDL, and create an application service under 'modeled' (and maybe rename some of the operations / object types)
• In the Composite Application perspective, right-click your project and select 'Generate', 'Build' and 'Deploy', subsequently
• I then code my consuming DC (mostly Web Dynpro) by importing the CAF EAR (EJB) model
• I then create a destination template, using the correct WSDL url and security settings
• I then map the deployed CAF operation to the destination template

[Former Member · Accepted solution]

Hi Robin,

Yes, I've done almost all those steps so far... my problem is with the last one tight now: "I then map the deployed CAF operation to the destination template":

I have created the destination and successfully deployed my CAF application with the web service imported in it. I can see it in the CAF service browser without issues. However, when I go to NWA > SAO > Destination Template Management > CAF configuration to map my CAF with the destination, it doesn't appear there (only the destination but no CAF to map it to). Do you have any idea why that is?

Thanks!

[Qualiture · Accepted solution]

Hi Alain,

I just checked on a newer NW environment (NW 7.2) and was presented an empty list as well... It seems the mapping procedure I described is deprecated since NW 7.11, and the modeled CAF application service is already exposed as a web service.

You may want to have a look at http://help.sap.com/saphelp_nwce711/helpdata/en/43/f173947bbb025be10000000a1553f7/content.htm or http://scn.sap.com/message/7852996 for more info