SOAP via SSL: Peer certificate rejected by ChainVerifier

[Former Member]

Dear All

We want to consume an external SOAP Service provided by a Partner using SSL.

In the Scenario SAP ERP calls the SOAP Service via SAP PI.

Our SAP Systems do NOT have SSL enabled.

Calling the SOAP Service directly from SOAP UI works fine.

When calling the Service from SOAP UI via SAP PI we always get the "Peer certificate rejected by ChainVerifier" exception.

com.sap.engine.interfaces.messaging.api.exception.MessagingException:
iaik.security.ssl.SSLCertificateException: Peer certificate rejected by
ChainVerifier
at com.sap.aii.adapter.soap.web.SOAPHandler.processSOAPtoXMB(SOAPHandler.java:702)
at com.sap.aii.adapter.soap.web.MessageServlet.doPost(MessageServlet.java:470)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:754)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)

The first question is, if it is supposed to work, if one part of the communication is non-SSL (SAP ERP/SOAP UI to SAP PI) and the other part of the communication is SSL enabled (SAP PI to external SOAP Service)?

To make SSL working i ran the URL to the external Service and downloaded the certificate of the browser. This certificate i uploaded to the Keystore in the NWA and selected it in the communication channel.

Is there anything wrong in this procedure?

When calling the URL in the browser, i do not get a warning in the browser, so the SSL certificate seems to be signed by a generally trusted authority.

Do i still need to get a root certificate of our Partner and upload that?

Remark: SAP PI is a NW 7.31 dual stack Installation.

Thank you very much for your Support!

Best Regards

Martin

[Former Member · Accepted solution]

Hello Martin,

in which keystore have you imported which certificate? It is important that you import the server certificate (the one you download from the page) to TrustedCAs (this is the default keystore). Then, if the server issues a client certificate and demands further authorization (signing, encrypting etc.), this certificate needs to be imported to your keystore called ICM_SSL_<InstanceNumber>.

The first step can be omitted if one certificate further up the chain is already available in your TrustedCAs.

In any case, you can check out NWA-->Troubleshooting-->Logs and Traces-->Security Troubleshooting Wizard and trace your SSL communication for further indication.

Regards,

Jörg

[Former Member · Accepted solution]

Hello Jörg

thank you very much for the reply.

You were right, i uploaded it to the wrong keystore instead of the TrustedCAs (really a lack of General understanding from my side, but there is just too much info about this Topic to see the missing part)

Best Regards

Martin

[Former Member · Accepted solution]

Hello Martin,

no problem, that's why there is a forum where you can ask questions. Glad that you resolved the issue!

Regards,

Jörg

[Former Member]

Hi Martin,

For SSl certificate u just need to maintain the cert in TrustedCAs in NWA. No need to select the cert for auth in PI comm channel

Regards,

Sriram

[Former Member]

Hi Sriram

you are right - short and correct!

Thank you for your Response and best Regards

Martin

[JaySchwendemann]

Martin,

Jörg and Azhar did already provide hints for your solution. It's important to distinct between two usage types

1. PI calling a "https url"

2. PI authenticating using a client certificate (as alternative or surplus to a password auth for example)

You are most probably in usage type 1.

If steps suggested above fail, try to narrow down e.g. by using XPI Inspector (my all purpose weapon 🙂

Cheers

Jens

[Former Member]

Hello Jens

Thank you for the reply too.

Type 1 is relevant for me. I did not use the XPI Inspector in the end, but thank you for the hint anyway.

Beste Regards

Martin

[azharshaikh]

Hi Martin,

Please check the following for similar issue:

Regards,

Azhar