sapgenpse get_pse for two CN (SAN certificate)

[petra_writz]

Hello,

we configured one webdispatcher für different Domains and Backends.

https://Domain1:443 --> is routet to a JAVA Netweaver

https//Domain2:443 --> is routet to an ICM of an ABAP ERP System

wdisp/system_<xx> - SAP Web Dispatcher - SAP Library

In our stage environment we don't have any problems, because we used an internal company certificate. We only delivered the two domains and get anpfx file, which we could import to webdispatcher without problems.

Now we want to set this configuration in our productive environment. We did a certificate request with IIS

http://techontip.wordpress.com/2011/06/06/how-to-create-a-san-certificate-signing-request-for-iis-we...

an send it to our certificate issuer. We get back an p7b file.

We tried to import this file, it doesn't work.

We changed p7b file to pfx file and tried to import it.

But we always get an error:

Error in import_p12: (9/0x0009) af_verify_Certificates failed

Error in af_verify_Certificates: (1538/0x0602) invalid algorithm

Algorithm md2WirhRsaEncryption (OID 1.2.840.113549.1.1.2), Parameter: NULL

Error in sec_verify_init: (1538/0x0602) invalid algorithm

Algorithm md2WirhRsaEncryption (OID 1.2.840.113549.1.1.2), Parameter: NULL

Error in sec_hash_init: (1538/0x0602) invalid algorithm

Algorithm md2WirhRsaEncryption (OID 1.2.840.113549.1.1.2), Parameter: NULL

Error in sec_verify_init: (1538/0x0602) invalid algorithm

Algorithm md2WirhRsaEncryption (OID 1.2.840.113549.1.1.2), Parameter: NULL

Error in sec_hash_init: (1538/0x0602) invalid algorithm

Algorithm md2WirhRsaEncryption (OID 1.2.840.113549.1.1.2), Parameter: NULL

ERROR in af_pse_get_PCAList: (42130/0x1022) Obejct PCAList doesn't exist

ERROR in af_pse_get_PKRoot: (42130/0x1022) Obejct PKRoot doesn't exist

We now want to try to create a certificate request with sapgenpse get_pse.

But we didn't find a description how to do this with two Common Names (CN).

So please somebody help us.

Best regards

Petra Wöritz

[Former Member · Accepted solution]

Hi,

Can you please explain why .

We now want to try to create a certificate request with sapgenpse get_pse.
But we didn't find a description how to do this with two Common Names (CN).

SSL certificate is valid for one name only. SSL certificates are used to identify a single server.

Why dont you get the cert generated with wild-character and like abcd.domain.com and zxcv.domain.com. So get the cert .

*.domain.com

Thanks

Rishi Abrol

[petra_writz · Accepted solution]

Hi,

we can't use wildcard, because the domains are different.

Like

https:\\abc.domain1.de

https:\\def.ghj.domain2.de

Best regards

Petra Wöritz

[Former Member · Accepted solution]

Hi,

Are there two web dispatcher.

https://Domain1:443 --> is routet to a JAVA Netweaver

https//Domain2:443 --> is routet to an ICM of an ABAP ERP System

Thanks

Rishi Abrol

[petra_writz · Accepted solution]

No, this is one webdispatcher.

It is a webdispatcher 7.3 and it can be used for two different systems:

http://help.sap.com/saphelp_nw72/helpdata/en/b0/ebfa88e9164d26bdf1d21a7ef6fc25/content.htm

Best regards

Petra Wöritz

[MaLoo · Accepted solution]

Hi Petra,

Did you find a solution for this?

Thanks, Martin

[Former Member · Accepted solution]

You need to use STRUST, see for details.

[MaLoo · Accepted solution]

No STRUST in webdispatcher Besides that, there's Java on the backend in our case. Additional, the two domain names we want to use have different owners, so a SAN certificate will be difficult. We are going to try to solve this with IIS.

[Former Member · Accepted solution]

If you don't have access to a AS ABAP system you could use OpenSSL instead. The SAP provided tool sapgenpse doesn't have the capability. It does however sound like your requirement is different from Petra's meaning having a SAN certificate is not a solution for you.

[petra_writz · Accepted solution]

Hello,

we now use a SAN certificate, which we ordered directly from our certificate issuer (Verisign).

This one we implemented in Webdispatcher.

Best regards

Petra Wöritz