Deploy Public Key pair Certificate in NWA

[Former Member]

Hi,

we are developing PI Interfaces through which flat files will be sent to client's FTP server. Client's requirement is that the data be sent in a secure way. We are using PI 7.1 EHP 1 SP05. Hence SFTP is not possible unless we upgrade to SP08, so we are proceeding further with FTPS (FTP over SSL).

For FTPS, we spoke to the client and got the Public key certificate. Now, the problem is when we try to deploy the public key certificate in the Netweaver Administrator.

I selected the key storage view TrustedCAs, and in the key storage view details, after selecting "Import Entry", there comes a pop up as below

How do we know what type of entry that the client has sent to us ?

Since, selecting PKCS#12 key pair was giving an error as "ERROR:  -> ID21108: ASN.1 creation error: iaik.asn1.CodingException: Invalid ASN.1 object: Unknown tag class/value: 0/13",and PKCS#8 was giving errors with the selection of the certificate file, I selected X.509 certificate and imported the file. It gives an error as "ERROR:  -> iaik.asn1.CodingException: ASN.1 creation error: iaik.asn1.CodingException: Length: Too large ASN.1 object: 106 "

Kindly refer to the public key certificate that is attached.

Please help us identify what the issue is. Thanks in advance.

Regards,

Vivek.

pubkey.txt.zip

[Private_Member_12188 · Accepted solution]

Looks like they've given you a public PGP key, I'm not certain that you can use that for SSL communication in PI (not really sure if that would work outside of PI either). 

Can you have them generate you a new certificate from their FTP server not using PGP?  They should be able to do this at the OS level.

[Former Member · Accepted solution]

Hi Tony,

Thanks for the reply. we have communicated the same to the client. Once we receive the newly generated certificate, we will try importing the same.

If we encounter any further errors, will update.

Regards,

Vivek.

[Former Member · Accepted solution]

Hi Tony,

We received a new certificate from the FTP service provider and we were able to import it successfully into NWA by mentioning the entry type as 'X.509'. We made all sort of port opening in the firewalls to support FTPS.

From PI OS level, telnet to the FTP server was successful via the ports 21(Control Port), 4xxxx(Dynamic data port). But from PI, when tried sending files to FTP server, It throws an error "Connection Timed Out". More details on the errors are in the latest responses of this discussion

Meanwhile, we are trying to resolve this issue by all possible ways. Hence I wanted to check whether the certificate that we received from the client is valid or not. In the content of the certificate file, there are two blocks of characters. One block is enclosed within the tags "BEGIN RSA PRIVATE KEY" and "END RSA PRIVATE KEY", the second block is enclosed within the tags "BEGIN CERTIFICATE" and "END CERTIFICATE".

Is it mandatory to have the first block (Private key) in the public key certificate ? I tried importing the certificate into NWA by manually removing the first block. It was successfully imported but the error from PI did not change.

Please let me know of any information that could help me move further towards solving the problem.

Thanks and Regards,

Vivek.

[Private_Member_12188 · Accepted solution]

One of the ways you can test out the FTPS process is by downloading a third party FTP program (e.g. WinSCP), install the certificates locally to your PI app server and try to connect that way.  That should help you determine if the issue is with the certificate or somewhere else.

Check out the following documents.  The first one I wrote when we were having issues with FTPS and PI 7.1.  The very first part will show you how to determine if your cert is valid and has the full certificate chain.

[Former Member · Accepted solution]

Hi Tony,

Thanks much for the response. I went through your blog and tried installing the certificate in windows, I got the same security warning pop up as you have mentioned.

Now, will the FTP service provider provide me the CA root certificate also ? I guess, the certificate that we received is a self-signed one.

If I get one, then I have to import both the CA root cert as well as the Public key cert into the Trusted CAs keystore view. Is there any other configurations that I have to do on the NWA, other than importing these certificates?

In your blog, point #2

2. For FTPs PI 7.1 can only use Explicit Encryption! You will need to work with your third party vendor to have their FTPs server setup to use Implicit Encryption for your connection.

Should the FTP server setup to use implicit encryption? I think, they have setup Explicit Encryption. Please clarify.

We have our PI installed on a Unix server. Will I be able to run Winscp from Unix ? I connected to the FTP server from a different PC which is out of the firewall using winscp client, and was able to drop files in the server.

In the blog, , it has been mentioned

Under command Order there is a Use x.509 Certificate for Client Authentication tick box. (select that on)

Keystore = TrustedCAs (select this from the value list)

x.509 Certificate and private key = TrustedCAs – Newly Imported Certificate

but, we are unable to get the certificates that we added in the Trusted CAs.

In the blog by Rajasekhar Reddy, , it is mentioned that the necessary configurations are to be made in the SAP J2EE Engine Administrator and Visual Administrator. I have access only to the Netweaver Administrator.When I checked with the Basis about this, they told me that these configurations are for windows server and not Unix. Hence, all the configurations are to be made from NWA. I hope we were using Visual Admin for older versions, and now we use only Netweaver Administrator. Please let me know whether I am right.

Rajasekhar has also mentioned in his blog about the enabling of ' Use X.509 Certificate for client authentication' check box in the Channel configuration. He has selected a standard service_ssl keystore view, will this be of any help? Shouldn't we select the certificate that we just imported in Trusted CAs ?

We couldn't see Trusted CAs listed here, and one more thing is this list shows only Private keys from the keystore. whereas my entry type is displayed as 'Certificate' in the keystore.

Thanks & Regards,

Vivek.

[Former Member]

Hi Vivek,

My client has provided me a .pfx file and when I am trying to import it in TrustedCA, Its giving error as

"ERROR:  -> ID21108: ASN.1 creation error: iaik.asn1.CodingException: Length: Too large ASN.1 object: 59.

Please let me know the solution that worked in your case.

Thanks,

Nida Fatima