Service could not be activated: SSL error(-14)

[Former Member]

Hi

i am trying to active service in webdisp  , i am getting error

profile parameter

SAPSYSTEMNAME = PRD

SAPGLOBALHOST = PRD

SAPSYSTEM = 04

INSTANCE_NAME = W04

DIR_CT_RUN = $(DIR_EXE_ROOT)\$(OS_UNICODE)\NTAMD64

DIR_EXECUTABLE = $(DIR_CT_RUN)

DIR_PROFILE = $(DIR_INSTALL)\profile

_PF = $(DIR_PROFILE)\PRD_W04_PRD

SETENV_00 = PATH=$(DIR_EXECUTABLE);%PATH%

#-----------------------------------------------------------------------

# Accesssability of Message Server

#-----------------------------------------------------------------------

rdisp/mshost = PRD01

ms/http_port = 8100

ms/https_port = 8200

#-----------------------------------------------------------------------

# Configuration for small scenario

#-----------------------------------------------------------------------

icm/max_conn = 100

icm/max_sockets = 1024

icm/req_queue_len = 300

icm/min_threads = 5

icm/max_threads = 15

mpi/total_size_MB = 20

#-----------------------------------------------------------------------

# SAP Web Dispatcher Ports

#-----------------------------------------------------------------------

icm/server_port_0 = PROT=HTTP,HOST=PRD,PORT=81$$

icm/server_port_1 = PROT=HTTPS,PORT=82$$

icm/HTTP/admin_0 = PREFIX=/sap/admin,DOCROOT=$(DIR_DATA)$(DIR_SEP)icmandir,AUTHFILE=NONE,PORT=81$$

#-----------------------------------------------------------------------

# Start webdispatcher

#-----------------------------------------------------------------------

_WD = $(DIR_EXECUTABLE)\sapwebdisp$(FT_EXE)

Start_Program_00 = local $(_WD) pf=$(_PF)

ssl/ssl_lib = $(DIR_EXECUTABLE)$(DIR_SEP)$(FT_DLL_PREFIX)sapcrypto$(FT_DLL)

sec/libsapsecu = D:\usr\sap\PRD\W04\sec\sapcrypto.dll

ssf/name = SAPSECULIB

ssfapi_lib = D:\usr\sap\PRD\W04\sec\sapcrypto.dll

ssl/ssl_lib = D:\usr\sap\PRD\W04\sec\sapcrypto.dll

ssl/server_pse = D:\usr\sap\PRD\W04\sec\SAPSSL.pse

ssl/client_pse= D:\usr\sap\PRD\W04\sec\SAPSSL.pse

wdisp/ssl_cred = D:\usr\sap\PRD\W04\sec\SAPSSL.pse

SETENV_01 = SECUDIR=$(DIR_INSTANCE)/sec

#icm/server_port_1 = PROT=HTTP,PORT=0

icm/HTTPS/verify_client=0

wdisp/add_client_protocol_header = true

wdisp/auto_refresh = 120

wdisp/max_servers = 100

wdisp/ssl_encrypt = 0

wdisp/ssl_encrypt=0

#icm/HTTP/redirect_0 = PREFIX=/, FROM=/, FROMPROT=http, PROT=https, HOST=sapprd01

#icm/HTTP/redirect_0 = PREFIX=/, FROM=/, TO=/sap, FROMPROT=http, PROT=https, HOST=sapprd01

error log

*** ERROR =>   secudessl_Create_SSL_CTX():  PSE "D:\usr\sap\PRD\W04\sec\SAPSSL.pse": unable to use! [ssslsecu.c   1848]

[Thr 8096] secudessl_Create_SSL_CTX: SSL_CTX_set_default_pse_by_name() failed --

[Thr 8096]   secude_error 1281 (0x00000501) = "open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned"

[Thr 8096] >> ---------- Begin of Secude-SSL Errorstack ---------- >>

[Thr 8096] ERROR in SSL_CTX_set_default_pse_by_name: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in ssl_set_pse: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in af_open: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in secsw_open: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in secsw_open_pse_or_extension: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in sec_get_PSEtype: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in aux_read_PSEFile: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] ERROR in aux_file2OctetString: (1281/0x0501) open("D:\usr\sap\PRD\W04\sec\SAPSSL.pse") returned : "Permission denied"

[Thr 8096] << ---------- End of Secude-SSL Errorstack ----------

[Thr 8096] *** ERROR => SapISSLAddCredential(): Error SSSLERR_PSE_ERROR trying to create SERVER Credential

        for "D:\usr\sap\PRD\W04\sec\SAPSSL.pse" [ssslxxi.c    2417]

[Thr 8096] *** ERROR => Initialization of SSL library failed -- NO SSL available!

[Thr 8096] =================================================

[Thr 8096]

[Thr 8096] <<- ERROR: SapSSLInit(read_profile=1)==SSSLERR_PSE_ERROR

[Thr 8096] *** ERROR => IcmServInitSSL: SapSSLInit (rc=-40): SSSLERR_PSE_ERROR [icxxserv.c   254]

[Thr 8096] *** WARNING => Could not start service (rc=-14) PORT=8204,PROT=HTTPS,TIMEOUT=60,PROCTIMEOUT=60,VCLIENT=0 [icxxserv.c   654]

[Thr 8136] IcmCreateWorkerThreads: created worker thread 0

[Thr 8136] IcmCreateWorkerThreads: created worker thread 1

[Thr 8136] IcmCreateWorkerThreads: created worker thread 2

[Thr 8136] IcmCreateWorkerThreads: created worker thread 3

[Thr 8136] IcmCreateWorkerThreads: created worker thread 4

[Thr 5852] IcmWatchDogThread: watchdog started

[Thr 6568] Wed Aug 13 22:09:02 2014

[Thr 6568] *** ERROR => IcmReadAuthData: could not open authfile: NONE - errno: 2 [icxxsec.c    642]

[Thr 5760] Wed Aug 13 22:09:08 2014

[Thr 5760] *** ERROR => IcmReadAuthData: could not open authfile: NONE - errno: 2 [icxxsec.c    642]

[Thr 8072] Wed Aug 13 22:09:10 2014

[Thr 8072] *** ERROR => IcmReadAuthData: could not open authfile: NONE - errno: 2 [icxxsec.c    642]

[Thr 6568] Wed Aug 13 22:09:17 2014

[Thr 6568] *** ERROR => IcmReadAuthData: could not open authfile: NONE - errno: 2 [icxxsec.c    642]

thanks

[Former Member]

Check if file SAPSSL.pse does exist ot the location and it has the right permission.
Right click on the file and check properties if correct user is set
You can set new password to pse using below command where password is your pse pin.Other details you can find using TCode strustsso2 or strust

sapgenpse get_pse -p SAPSSL.pse -x password -r SAPSSL.req "CN=abc.com, OU=abc, OU=SAP

For more details follow below link

http://help.sap.com/saphelp_nw70ehp1/helpdata/en/48/9a9a6b48c673e8e10000000a42189b/frameset.htm