Invalid certificate in a mobile connection.

[Former Member]

I am trying to set up an SMP 3.0 server in a DMZ running a custom build Agentry application.  The mobile application will be running on iPads running ios 9.3.2 using the SAP Mobile Platform Agentry Client v70.12.1.1.  The mobile device will be communicating over AT&T wireless.  An external facing IP address was established and is being translated to the internal IP address on the company network.  When setting up the SMP server in the DMZ, a self signed certificate was generated to correspond to the external facing server name (DNS) using for connecting to the internal network.  The new cert generated was loaded on the iPad, however I am receiving an SSL Invalid Chain error when trying to connect the mobile device to the SMP server in the DMZ.  The generated certificate is stored in the smp_keystore on the server, but the old certificate is still contained in the local_smp_keystore on the server.  Has anyone set up an SMP 3.0 server in a DMZ, communicating with iPad devices using a public wireless network?  What guidance can you provide to assist me in eliminating the invalid certificate issue that I am encountering?

Ernie

[bill_froelich]

When you generated the new self-signed certificate corresponding to the external facing server name, it needs to be loaded into the local_smp_keystore under the smp_crt alias.  That is the alias the SMP server presents to connecting devices.

You can always check what certificate is being presented by connecting from a web browser pointing to the Agentry URL https://external-server-name:8081/{urlPath}.  You should get the I am here! message if everything is up and running. 

I typically connect using my laptop running IE so I can continue to the site if not trusted or click the certificate in the address bar to view the received certificate (about the only redeeming quality in IE) and install if needed.

--Bill