SSF_API_SIGNER_ERRORS :: Error during verify - signer error.

[Former Member]

Hello all,

after doing a system copy of our solution manager 7.01 (SPS 24) system I can't log on via WEBGUI to the target of the system copy.

The problem seems to have something to do with the certificate of the new system.

I get the following error message in the trace file:

N MYSAPSSO2 ticket last error from SSF: ERROR in

af_search_Certificate_IS: (105/0x0069) No certificate found

I already deleted the systems own certificate in the System PSE an had it recreated by restarting the server.

It looks like the system is not accepting it's own certificate, though.

Here are the relevant parts of dev_w0:

* ACTIVE TRACE LEVEL 2
* ACTIVE TRACE COMPONENTS all, NH

N InternetUserLogon called in testmode => 'authenticate-only'
N dy_signi_ext: LOGON TICKET logon (client 000)
N mySAPUnwrapTicket: was called.
N mySAP: Got the following SSF Params:
N DN =CN=M12

N EncrAlg =DES-CBC
N Format =PKCS7
N Toolkit =SAPSECULIB
N HashAlg =SHA1
N Profile =/usr/sap/M12/DVEBMGS02/sec/SAPSYS.pse
N PAB =/usr/sap/M12/DVEBMGS02/sec/SAPSYS.pse
N Got the codepage 4102.
N Got ticket (head) AjQxMDIBABgASABFAE4AUgBJAEMASQAgACAAIAAg. Length =
480.
N *** ERROR => SsfVerify failed (see note 1055856). [ssoxxsgn.c 144]
N {root-id=509105D409B00830E10080000ACA0846}_{conn-
id=509103DF098D10F0E10080000ACA0846}_1

N SsfVerify returned 5 :: SSF_API_SIGNER_ERRORS :: Error during
verify - signer error.
N MYSAPSSO2 ticket last error from SSF: ERROR in
af_search_Certificate_IS: (105/0x0069) No certificate found
N ERROR in _pse_get_TBS_by_keyUsage: (105/0x0069) Requested PK not
found in PKList/EKList
N ERROR in af_pse_get_PKList: (4130/0x1022) Object PKList doesn't existN ERROR in af_pse_get_PKList: (4130/0x1022) Can't get PKList because
cannot read object : "PKList"
N ERROR in sec_read_PSE: (4130/0x1022) object is not in toc : "PKList"
N ERROR in sec_read_object_from_toc: (4130/0x1022) object is not in
toc : "PKList"
N .
N SSF LIB returned 27 :: SSF_API_RECIPIENT_NOT_OK :: Operation not ok
for recipient.
N Signer ID: CN=M12/No-20:12:10:30:09:27:05
N Signer info: SigningTime= Wed Oct 31 12:01:21 2012 (UTCTime:
121031110121Z)
N *** ERROR => ValidateTicket failed with rc = 5 and ssf_rc = 27.
[ssoxxapi.c 235]
N {root-id=509105D409B00830E10080000ACA0846}_{conn-
id=509103DF098D10F0E10080000ACA0846}_1

N *** ERROR => Ticket validation failed with rc = 5 and ssf_rc = 27.
[ssoxxkrn.c 993]
N {root-id=509105D409B00830E10080000ACA0846}_{conn-
id=509103DF098D10F0E10080000ACA0846}_1

Thanks for your support !

[Former Member · Accepted solution]

Hello,

I solved the problem by implementing Note 1596277: SAP GUI for HTML: JavaScript files are not found

The problem of not being able to access the WEBGUI in Solman 7.1 SPS6 was that Internet Service SYSTEM was not published in SE80.

If you come across this it will show the following HTTP 404 errors in icmhttp.log

"GET /sap/public/bc/its/mimes/system/sl/script/sap_secu.js HTTP/1.1" 404 368 [11] h[-] |

"GET /sap/public/bc/its/mimes/system/sl/script/its_domain.js HTTP/1.1" 404 370 [19] h[-] |

"GET /sap/public/bc/its/mimes/system/sl/script/its_frameset.js HTTP/1.1" 404 372 [23] h[-] |

"GET /sap/public/bc/its/mimes/system/sl/script/its_utils.js HTTP/1.1" 404 369 [24] h[-] |