Netweaver Business Client (NWBC) HTTPS Issues

[Former Member]

Hello Gurus,

I'm new to BASIS and I need to configure HTTPS connectivity for NWBC. We have a client with a very locked-down internal network, and they continually have standard HTTP content blocked. I would like to use HTTPS to alleviate this.

I have enabled the HTTPS service in SMICM, and restarted the server. The NWBC service is running. System is release 7.31.

When I try to launch NWBC over HTTPS, I am getting no data back from the server. The web error says "Unable to make a secure connection to the server". I can launch NWBC via HTTP successfully, but if I enable HTTPS and the protocol switches, I see this error.

Am I missing steps in configuration of the server for HTTPS?

Thanks

[Former Member · Accepted solution]

It isn't sufficient to just activate the HTTPS port. Follow the instructions given in the application help.

[Former Member · Accepted solution]

Hello Samuli,

I have installed SAPCRYPTOLIB, and set profile parameters. Do I need to have my certificates in STRUST signed by CA? Or what process can I follow to self-sign? Could this be the problem in not getting HTTPS connections through to the server?

[Former Member · Accepted solution]

You can use a self-signed SSL server certificate for now, just be sure to trust the certificate you use to sign the certificate. AS ABAP needs a certificate to establish SSL.

[Former Member · Accepted solution]

How do I self-sign the certificate?

[Former Member · Accepted solution]

The SSL Server PSE contains a self-signed certificate, subject and issuer are the same. In other words you can skip the generation of CSR and importing of a signed certificate. You just have to export the certificate from the SSL Server PSE and import into your browser and set as trusted. I'm not sure if you can sign certificates in STRUST, I know you can do it with OpenSSL. For the latter, see Enabling X.509 based SSO for the SAP Web AS ABA... | SCN for reference.

[Former Member]

I would still suggest that you try the test in my reply - if this is an SSL issue, then probably best to move that dialog to the Netweaver forum instead of NWBC.

As Samuli said, the cert in the PSE is already self-signed if you followed the general SSL setup and skipped the signing.  If you hit the URL I listed and get a cert warning, just accept the warning (that it is not signed!) and see if you get to the "server reached successfully" page.  If you did, then SSL should be working.

[Former Member]

Hi Eric, I have tested the sap/public/ping service you mentioned. I am not getting a certificate error; I am getting an SSL error: Unable to make a secure connection to the server.

So this appears to be an SSL issue instead of anything else.
Thanks for your input.

[Former Member]

To validate HTTPS, see if you can hit this page: https://<hostname>:<ssl port>/sap/public/ping

If not, make sure the service is activated in SICF (may not be if the environment is locked down)  and then have a look at the trace files in SMICM.  The SAP crytpolib traces can be, for lack of a better word, cryptic -- but they usually are helpful!