Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Thu, 30 Jul 2015 08:00:09 GMT

Dear Experts

Facing to following problem:

IPs and names replaced with X.

I had to change the connection to content server to HTTPS. In IIS everything seems fine and the following page can be displayed:

https://fqdn:1092/ContentServer/ContentServer.dll?serverInfo

Now to sap. There I wanted to change the repository to HTTPS and changed the SSL Port to 1092 and then following error is displayed:

Fehler bei HTTP-Zugriff: IF_HTTP_CLIENT->RECEIVE 1 SSL handshake with XXX.XXX.XXX.XXX:1092 failed: SSSLERR_PEER_CERT_UNTRUSTED (-102) The peer's X.509 C...

In ICM Trace I see the following:

[Thr 7436] << End of Secu-SSL Errorstack

[Thr 7436] SSL_get_state()==0x2131 "SSLv3 read server certificate B"

[Thr 7436] SSL NI-hdl 96: local=XXX.XXX.XXX.XXX:57991 peer=XXX.XX.XXX.XXX:1092

[Thr 7436] <<- ERROR: SapSSLSessionStart(sssl_hdl=000000002ED2E2D0)==SSSLERR_PEER_CERT_UNTRUSTED

[Thr 7436] *** ERROR => SSL handshake with XXX.XXX.XXX.XXX:1092 failed: SSSLERR_PEER_CERT_UNTRUSTED (-102)

[Thr 7436] The peer's X.509 Certificate (chain) is untrusted

[Thr 7436]

[Thr 7436] SapSSLSessionStart()==SSSLERR_PEER_CERT_UNTRUSTED

[Thr 7436] SSL:SSL_connnect() failed (536872221/0x2000051d)

[Thr 7436] => "SSL API error"

[Thr 7436] >> SecuSSL ErrStack:

[Thr 7436] 0x2000051d SAPCRYPTOLIB SSL_connect

[Thr 7436] SSL API error

[Thr 7436] Failed to verify peer certificate. Peer not trusted.

[Thr 7436] 0xa0600203 SSL ssl_verify_peer_certificates

[Thr 7436] Peer not trusted

[Thr 7436] 0xa0600297 SSL ssl_cert_checker_verify_certificates

[Thr 7436] peer certificate (chain) is not trusted

[Thr 7436] Certificate:

[Thr 7436] Subject :CN=XXXX

[Thr 7436] Issuer :CN=XXXIssuingCA10, DC=XXX, DC=XXX

[Thr 7436] Serial number:0x5f0000029aa3d4c73fef2981bc00000000029a

[Thr 7436] Validity:

[Thr 7436] Not before :Mon Jul 27 16:20:44 2015

[Thr 7436] Not after :Sun Jul 25 16:20:44 2021

[Thr 7436] Key:

[Thr 7436] Key type :rsaEncryption (1.2.840.113549.1.1.1)

[Thr 7436] Key size :2048

[Thr 7436] PK_Fingerprint_MD5:3193 E726 99A2 F10C 97EA A73D CC6C 61AE

[Thr 7436] extensions:

[Thr 7436] AuthorityKeyId:

[Thr 7436] Significance:Non critical

[Thr 7436] Value:

[Thr 7436] Key identifier (size="20" ):42F8D3D3DBA97D29F79921B8F262898FD0084A36

[Thr 7436] SubjectKeyIdentifier:

[Thr 7436] Significance:Non critical

[Thr 7436] Value (size="20" ):8BC3DAB1F979D139CAE2731DAACD5CB67CA3EB58

[Thr 7436] Key usage:

[Thr 7436] Significance:Critical

[Thr 7436] Value:

[Thr 7436] digitalSignature

[Thr 7436] keyEncipherment

[Thr 7436] Extended key usage:

[Thr 7436] Significance:Non critical

[Thr 7436] Value:

[Thr 7436] element#no="1":ClientAuthentication (1.3.6.1.5.5.7.3.2)

[Thr 7436] element#no="2":ServerAuthentication (1.3.6.1.5.5.7.3.1)

[Thr 7436] Alternative names:

[Thr 7436] Significance:Non critical

[Thr 7436] Value:

[Thr 7436] element#no="1":

[Thr 7436] GN-dNSName :XXX

Then I added this certificate to STRUST. But still facing to the same error.

Thanks for any advices.

Kind regards

Lino

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

SSB — Sat, 01 Aug 2015 16:57:35 GMT

Please Send the Certificate using transaction OAC0 and activate it on content server.

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Mon, 25 Jan 2016 11:11:24 GMT

Hello Lino,

you need to add the root certificate to SSL Client and add to Certificate List to make it work.

This is because here in this case ABAP server works as a client.

Regards,

Eswaran

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Mon, 25 Jan 2016 11:32:10 GMT

Hi Eswaran

This issue's been solved. There were a lot of wrong certificates imported during the installation phase. Once I did all new it worked.

Thanks for your reply!

kind regards

Lino

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Tue, 02 Feb 2016 09:40:15 GMT

Hi Lino,

Please guide from which site to download certificate and next steps.

Rohit

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Fri, 26 Feb 2016 11:22:48 GMT

Please let us know, how have you done it .. ?

Regards..

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Former Member — Fri, 26 Feb 2016 12:00:04 GMT

Hi Samrat,

The issue is due to SSL certificated which are generated with wrong input.

Try re-generating certificates with correct options and test. it worked for me.

Regards,

Shree

Question Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS in Additional Q&A

Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Fehler bei HTTP-Zugriff: IF_HTTP_CLIENT->RECEIVE 1 SSL handshake with XXX.XXX.XXX.XXX:1092 failed: SSSLERR_PEER_CERT_UNTRUSTED (-102) The peer's X.509 C...

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS

Re: Content Server SSL - SSL Connect failed - Connection not possible with HTTPS