Can't create PSE

[Former Member]

Hi all.

I'm in trouble and need help.

I need to make remote connection to SAP.

System is Linux.

I copied saprouter files to my system, extracted them from archive made test by niping. All is OK.

But I cant create certificate request to register my SAP router. Here is what I get when I am implementing sapgenpse command

[user@evn-ibm3650-kvm1 sap]$ ./sapgenpse get_pse -v -r certreq -p local.pse "CN=name.name.am, OU=0001193359, OU=SAProuter, O=SAP, C=DE"

Got absolute PSE path "/home/shteadmin/sec/local.pse".

Please enter PSE PIN/Passphrase: ********

Please reenter PSE PIN/Passphrase: ********

Supplied distinguished name: "CN=name.name.am, OU=0001193359, OU=SAProuter, O=SAP, C=DE"

Creating PSE with format v2 (default)

get_pse: Can't create PSE.

I cant understand what is the problem if there is no error.

[former_member185954 · Accepted solution]

Hello Aram,

Before you chreate PSE, can you setup the SECUDIR environment variable to ensure you are creating the PSE in the correct directory ?

Got absolute PSE path "/home/shteadmin/sec/local.pse".

[Former Member · Accepted solution]

Hello Siddhesh

I Set both enviroment variables:

SECUDIR = <directory_of_SAProuter>

SNC_LIB = <path_to_libsecude>/<name_of_sapcrypto_library>

As described in guide.

[former_member185954 · Accepted solution]

Hello Aram,

You are creating the certificate request and local.pse in the same command, you can seperate them out by issuing two commands ( refer https://websmp106.sap-ag.de/saprouter-sncdoc)

The first command will create the local.pse and the second will create a certificate request from local.pse, try this method to isolate the issue.

sapgenpse get_pse -v -noreq -p local.pse "<Distinguished Name>"
sapgenpse get_pse -v -onlyreq -r certreq -p local.pse

If you can get sapgenpse to create the local.pse then 50% of your work is done, we can then concentrate on creating the certificate request.

Regards,

Siddhesh

[Former Member · Accepted solution]

Hello Siddhesh,

thank you for replays

I have tried this method too. The issue is in firs command, I receive get_pse: Can't create PSE. after first command.

Is there any pre requirements that I must done before perform sapgenpse command?

Or is there any method to log all the steps of work of program to understand the issue.

Best regards,

Aram

[former_member182657 · Accepted solution]

Hi,

Could you share parameters value for both

SECUDIR 

SNC_LIB 

In addition suggest you to follow SCN doc at http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c06c8846-c160-2d10-d18e-d9961e9c7...

& re check your steps which you followed during the process.

Also you could check with SAP Note 2131531 - New Root Certification Authority for saprouter certificates

or best would be to follow steps as per SAP  https://support.sap.com/remote-support/help/installing-saprouter.html

Regards,

[Former Member · Accepted solution]

Hello Aram,

You're almost there. I believe you have not created the directory you are specifying for SECUDIR.

You must ensure that the full path you specify for SECUDIR exists

1. mkdir <directory_of_SAProuter>/sec

2. export SECUDIR=<directory_of_SAProuter>/sec

3. export SNC_LIB=<path_to_libsecude>/<name_of_sapcrypto_library>

4. sapgenpse get_pse -v -r certreq -p local.pse "CN=name.name.am, OU=0001193359, OU=SAProuter, O=SAP, C=DE"

KR,

Amerjit

[former_member185954 · Accepted solution]

Hello Aram,

I was under the impression that you would have created the directories

Anyways, good to know your problem is resolved.

Regards,

Siddhesh