CA certificate missing in database while importing certificate in ABAP

[Former Member]

Hello,

We have installed SAP cryptographic libraries and generated a SSL PSE. Later we generated the CSR and sent to verisign. While importing the signed certificate we are constantly getting the error message "CA certificate missing in database" .

We have created an entry in STRUSTCERT table using SE16 and but still we are getting the same error message. Please let me know how to get rid of this error message and proceed further.

Thanks,

Praveen

[former_member402999]

Hi Praveen,

for adding a certificate to the database, please load the certificate into transaction STRUST and choose Certificate -> Export -> Database from the menu. However, since Verisign uses intermediate certificates (which cannot be stored in the database), you need to copy the root and the intermediate certificate from Verisign into the certificate response before importing it into the SSL PSE.

Best regards,

Klaus

[Former Member]

Hi Klaus,

I'm having trouble with establishing the SSL connection. I've managed to import the certificate response but I've a doubt. When you say : 'you need to copy the root and the intermediate certificate from Verisign into the certificate response before importing it into the SSL PSE' do you mean importing the root and the intermediate certificate into the certificate list? If not, how can I copy the root and intermediate certificates into the certificate response?

Thanks in advance Klaus,

[Former Member]

Hi,

>how can I copy the root and intermediate certificates into the certificate response?

Your certificates should be base 64 encoded.

Use a text editor (notepad for windows for exemple) and copy and paste the CA and subCA certificates in the certificate response.

You should get a text file looking like :

-

---

BEGIN CERTIFICATE-----

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

---

END CERTIFICATE-----

-

---

BEGIN CERTIFICATE-----

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

---

END CERTIFICATE-----

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

---

END CERTIFICATE-----

Regards,

Olivier

[Former Member]

Hi Olivier,

Thanks for your suggestion!

Do you have to copy them in a specific order? Meaning, the txt file starts with:

-

-

---

BEGIN CERTIFICATE (of certificate response) -

-

---

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

-

---

END CERTIFICATE-----

-

-

---

BEGIN CERTIFICATE ( of subCA certificate)-----

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

-

---

END CERTIFICATE-----

-

-

---

BEGIN CERTIFICATE ( of CA certificate)-----

MIIGJDCCBY2gAwIBAgIKeAhSUQADAAAqhkiG9w0BAQUFADCBhDELMAkG

..........

-

-

---

END CERTIFICATE-----

or the order matters and is the other way round? I am asking this question since after cut&copy am having an error on testing the connection.

I'm getting:

'the verification of the server's certificate chain failed

Can't get path because the chain of certificates is incomplete'

I'm quite sure that all the certificates were included....

Thanks Olivier

Edited by: Gonçalo Mouro Vaz on Sep 16, 2008 1:27 PM

[Former Member]

Hi Gonçalo,

Yes the order is important.

If I remember well, you have to put them in the order you showed.

response

subCA

rootCA

PS: if on Windows, beware of end of lines characters.

Prefer a copy and paste from notepad to STRUST than importing the file from STRUST.

Regards,

Olivier

[Former Member]

You should also consider the use of the command line utilities, especially sapgenpse, in this case. With sapgenpse, you can put all certificate (including intermediate CA certificates) directly into the PSE.

As Klaus pointed out above, STRUST is a little bit restrictive regarding this.

[Former Member]

Hi Sietze,

I'm still having problems importing the certificate response, I keep getting 'Issuer certificate missing in database'. Despite the fact that I've created all the entries in table STRUSTCERT and had the CA Certificates exported into the database using STRUST, when I select (in STRUST) the option 'import certificate response' I keep getting that error.

Can you tell me how can I import the certificate response using sapgenpse? And what is the difference in using sapgenpse or strust?

Thanks Sietze,

[Former Member]

1. Use "sapgenpse gen_pse" for creating a PSE.

2. Use "sapgenpse gen_pse -r" for generating a PKCS#10 request.

3. Get this request signed by your CA.

4. Use "sapgenpse import_own_cert" for importing the certificate chain back. You'll have to add all (sub) CA certificate in this file as well.

5. Import the resulting pse into STRUST.

Another way to do this is using Windows where you can also do these operations via a GUI. At the end, you'll have to export everything in PKCS#12 format (file ending is .pfx), use sapgenpse to convert the .pfx file into a PSE (file ending .pse) and import this file into STRUST.

Still confused? This is all from memory, so I hope I didn't forget an important step! It would take a few hours to make screen shots and so on. Perhaps I'll put such instructions in a blog sometime in the future....

[jgleichmann]

Hello,

may be this blog can help you:

Best Regards,

Jens

Edited by: Jens Gleichmann on Oct 31, 2008 10:47 AM

Blog is available