SSL Install problem in HA environment

[adam_recktenwald]

Hello all,

I'm having a problem installing a SSL Cert on J2EE that is configured in a High Availability environment.

I've installed several SSL certificates on non-HA servers with no problem... and when I follow those same steps in this environment, I get an error.

When opening Key Storage in Visual Admin I get:

"IAIK Security library not found!"

"java.lang.NoClassDefFoundError: iaik/security/provider/IAIK"

I've Un-Deployed and Re-Deployed the Java Crypto SDA w/ no avail.

In Server -> Libraries -> Core_Lib I'm getting a UNC path to the SCS for the iaik_jce.jar file... which I think might be part of the problem. I've tried various file system permission tweaks with no difference.

Anyone know how to change that path or have a better solution?

Thanks!

-Adam

[Former Member · Accepted solution]

Hi Adam,

Copy the iaik_jce.jar or iaik_jce_export.jar from the SCS Instance
<HOST>\SAPMNT\<SID>\SYS\global\security\lib\tools\iaik_jce.jar to your CI \usr\sap\<SID>\JC<Inst. Nr.>\j2ee\admin\lib

Now you should be able to open the Key Storage in the Visual Admin

Peter

[former_member282370 · Accepted solution]

Peter,

I had the exact same problem and upon searching SDN I found this post. I've never searched SDN and found an exact solution so quickly. Thanks for your help.

JP

[former_member396612 · Accepted solution]

Great it worked.....

[Former Member · Accepted solution]

Dear Mr. Peter,

After a long search, i found something similar to my requirement and expecting your help from you.

I am trying to implement digital signature on form 16 and for this SSL between ABAP and JAVA (ECC 6.0 EHP6 dual stack) is required.

ADS is working fine.

I have done the same thing in standalone environment and I am clear with the process but in HA I am little bit confused between what “CN” should be used while creating server csr  or JAVA Certificate either “my cluster name” or * (for example, “ehpasclust.abc.com” or  “*.abc.com”) where “ehpasclust” is my cluster name and “abc.com” is my domain name.

We have total five physical servers

EC App 1	GURNTV360.ABC.COM
EC App 2	GURNTV361.ABC.COM
EC App 3	GURNTV408. ABC.com
EC DB Node 1	GURNTV362. ABC.COM
EC DB Node 2	GURNTV363. ABC.COM

Thanks in advance

Rgds,

Sanjeet

[Former Member]

Peter's solution got us going!

XI/PI under NW702

[Former Member]

Thank you Peter Ciasto,

The solution : copy iaik_jce.jar from \global\security\lib\tools\ to j2ee\admin\lib works fine

Best Regards

[Former Member]

Thank you Peter Ciasto,

The solution : copy iaik_jce.jar from \global\security\lib\tools\ to j2ee\admin\lib works fine

Best Regards

[Former Member]

Dear Peter,

exact solution and quickest one.. great.. i too enjoyed..

Regards,

Dineshkumar.G

[Former Member]

Hi Adam

Could you please let me know where i can find the J2ee cluster/HA documentation ??

We are using XI and are in need to set this up

Best Regards

Tord

[jochen_rundholz]

go to service.sap.com/ha --> media library --> documentation there is a guide especially for XI

[todd_miller2]

I received the same error "java.lang.NoClassDefFoundError: iaik/security/provider/IAIK" when

trying to run a local windows version of the Visual Administrator and accessing the keystore.

To get around this issue, I downloaded the SAP Crytographic Software for windows and unpacked

it. You will find a file named "tc_sec_java_crypto_signed_fs_lib.sda" located in the "jdk1.4x"

directory of the extracted files. Please note that I selected the jdk1.4x due to my local

environment. The name of the sda file varies depending upon the version of the jdk directory you choose.

Open this file with WinZip and extract the jar files into your

(Visual Administrator installation directory)\lib directory.

[nelson_raj2]

Hi Todd,

I have the exact same issue, and I have tried what you have written, but still faced the same error. How does putting the files in the Windows Visual Admin directory help when the error clearly states : java.lang.NoClassDefFoundError: iaik/security/provider/IAIK.

I tried the earlier suggestion of copying iaik_jce.jar to /sapmnt/D23/DVEBMGS01/j2ee/admin/lib and it has worked beautifully. Thanks!

Regards,

Nelson S. Raj

Edited by: Nelson Raj on Jan 22, 2008 10:23 AM