SAP router

[former_member227363]

Dear all,

I am tryng to setup our Solman’s connection to OSS for continuing the initial setup, but I came across an error which I can’t solve and can’t find any solution on the internet.

Issue- 1. Unable to START sap router services

2. SAPOSS rfc connection test failed

3. tcode -OSS1 = unable to connect ( message popup- running in defult connection ) 

error - DEV_ROUT

Sat May 30 13:54:50 2015

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [sncxxall.c 3585]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]

      GSS-API(maj): Miscellaneous failure

      GSS-API(min): A2200223:Peer certificate path not trusted

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;000000000258F300;1941) [nisnc.c      1010]

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [sncxxall.c 3585]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]

      GSS-API(maj): Miscellaneous failure

      GSS-API(min): A2200223:Peer certificate path not trusted

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;000000000258F300;1941) [nisnc.c      1010]

RFC connection test screen shot provide below please find.

SAP ROUTER Service

[former_member182657]

Hi,

Hope you already been aware about New SAP Router certificate policy and followed SAP Note 2131531 - New Root Certification Authority for saprouter certificates

If not kindly follow the steps as mentioned under SAP Note 2131531 & doc for successful router connections as well as SAPOSS connections.

GSS-API(min): A2200223:Peer certificate path not trusted

You could refer SAP Note 1867829 - List of SNC Error Codes

In my opinion best would to follow SAP Note first,if still issue persists re-share the dev_rout & SAPOSS test connection results.

Good luck !!

[former_member227363]

Dear gaurav,

Sorry i cant understand your comment.

[former_member182657]

Hi Sandeep,

OSS1 screen seems fine here,i would suggest you to follow previously mentioned SAP Note 33135,part Appendix A for the resolution.

Regards,

[former_member182657]

Hi Sandeep,

can you give some views on - SAP stop OSS1 tcode ( as per sap note 33125 )

The correct SAP Note here is 33135 - Guide for OSS1

If possible could you share OSS1 snap-shot,meanwhile i suggest you to refer recommendations under

Appendix A

Hope this will help you.

Good luck !!

[former_member227363]

Dear gaurav,

I tried to recreate SAPOSS rfc connection by useing OSS1 and its created but still the OSS1 is not working, but my rfc connection working.

can you give some views on - SAP stop OSS1 tcode ( as per sap note 33125 )

Thanks and regards

SANDEEP

[former_member227363]

Dear gaurav,

Thank you for your valuable response, i restarted the server and my OSS connection started working, But in Tcode- OSS1 its showing ( default connection ) and its not working.

Please find the screenshot.

Once again thanks garurv, if possible please share some more views regarding OSS1 tcode.

Thanks and regards

SANDEEP

[former_member182657]

Hi,

Could you check correct configurations or values under OSS1,if possible try to delete SAPOSS RFC from SM59 & recreate it via OSS1 transaction to test again .

Regards,

[former_member628188]

I also got the below error:

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [/bas/745_R 3638]
*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [/bas/745_REL/sr 3604]
GSS-API(maj): Miscellaneous failure
GSS-API(min): A2210238:The temporary key is not yet valid
Unable to establish the security context
target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"
<<- SncProcessInput()==SNCERR_GSSAPI
*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;0x87eb50;97) [nisnc.c 1003]

and restarting the server resolved my issue, however, the certificate was also valid.

[former_member182657]

Hi Sandeep,

Could you re-share dev_rout & SAPOSS test connection results.

Regards,

[former_member227363]

Dear gaurav,

Still i am getting the same error.

Thanks and regards

SANDEEP

[former_member182657]

You should follow statement

From 04/15/2015 11:00 AM CET until 07/18/2015 you need to import the old SAProuter Root CA manually:

The old SAProuter SMP Root CA certificate is attached to SAP note 2131531.
This is necessary, since SAP has to keep using saprouter certificates signed by the old SAProuter SMP Root CA for interoperability reasons. If you omit this step, SNC connections to SAP cannot be established.

This will resolve you issue.

Good luck !!

[former_member182657]

Hi,

Have you followed SAP note 2131531 ? You can see you're getting saprootca.der is not existing,the same file is already attached with the mentioned SAP Note & you need to import first for the successful setup.

I strongly suggest you to consider mentioned SAP Note to resolve your issue.

Regards,

[former_member227363]

Dear gurav,

As per your suggestion, i tried but still the same issue

. please find the screen short.

[former_member182657]

Hi Sandeep,

ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]
      GSS-API(maj): Miscellaneous failure
      GSS-API(min): A2200223:Peer certificate path not trusted
    Unable to establish the security context
    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

A2200223 Peer certificate path not trusted.

The certificate verification failed because the certificate path is not complete (CA certificate is missing), or the root certificate is not trusted.

Addition to it,please share values for below parameters or maintain as per below recommendations

SECUDIR = <directory_of_SAProuter>
SNC_LIB = <path_to_libsecude>/<name_of_sapcrypto_library>

& output of command sapgenpse get_my_name -v -n Issuer   .

Don't forget to execute the steps as suggested at SMP

From 04/15/2015 11:00 AM CET until 07/18/2015 you need to import the old SAProuter Root CA manually:

The old SAProuter SMP Root CA certificate is attached to SAP note 2131531.
Import the old SAProuter SMP CA Root CA certificate as trusted into your PSE. 
sapgenpse maintain_pk -a smprootca.der -p local.pse 
This is necessary, since SAP has to keep using saprouter certificates signed by the old SAProuter SMP Root CA for interoperability reasons. If you omit this step, SNC connections to SAP cannot be established.

Regards,

[former_member227363]

Dear garrav,

Thanks for reply, But still i am facing same issue.

Please find dev_rout error details.

Mon Jun 01 08:20:05 2015

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [sncxxall.c 3585]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]

      GSS-API(maj): Miscellaneous failure

      GSS-API(min): A2200223:Peer certificate path not trusted

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;00000000020EF2E0;1941) [nisnc.c      1010]

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [sncxxall.c 3585]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]

      GSS-API(maj): Miscellaneous failure

      GSS-API(min): A2200223:Peer certificate path not trusted

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;00000000020EF2E0;1941) [nisnc.c      1010]

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [sncxxall.c 3585]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI  [sncxxall.c 3551]

      GSS-API(maj): Miscellaneous failure

      GSS-API(min): A2200223:Peer certificate path not trusted

    Unable to establish the security context

    target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;00000000020EF2E0;1941) [nisnc.c      1010]