topic Re: resumed SSL session, NO client cert in Application Development and Automation Discussions

resumed SSL session, NO client cert

Former Member — Mon, 25 Nov 2013 08:19:03 GMT

hi SAP Expert,

Currently i was trying to setup the SSO using X.509 Certificate, but after perform the steps below, i still having this log "resumed SSL session, NO client cert" in my smicm logs trace level 3. any clue? thanks.

RZ10 :

icm/HTTPS/verify_client 1

ssf/name SAPSECULIB

sec/libsapsecu E:\usr\sap\CSB\SYS\exe\uc\NTAMD64\sapcrypto.dll

ssf/ssfapi_lib E:\usr\sap\CSB\SYS\exe\uc\NTAMD64\sapcrypto.dll

ssl/ssl_lib E:\usr\sap\CSB\SYS\exe\uc\NTAMD64\sapcrypto.dll

Strust :

server name : aws-sandbox-sap-crm-app.domain.com

SSL server Standart created with detail :

- owner : CN=sandbox-hcilink.domain.com, O=company, L=Port Washington, SP=New York, C=US

- certificate list : CN=sandbox-hcilink.domain.com, O=company, L=Port Washington, SP=New York, C=US

SM30 : VUSREXTID (DN)

external ID : CN=sandbox-hcilink.domain.com, O=company, L=Port Washington, SP=New York, C=US

user : yangha <- my SAP user id

Re: resumed SSL session, NO client cert

guilherme_deoliveira — Mon, 25 Nov 2013 16:41:47 GMT

Hello Hariyono,

The message "resumed SSL session, NO client cert" means that your client and server does not trust each other, therefore client certificates are not being used for authentication.

There is more than one reason for such message... The most common is if your Server PSE uses a self-signed certificate and this certificate is not imported into your client PSE (which does not seems to be the case here)... It seems that your CA Root and Intermediate certificates are not imported into your

Client PSE. Please double check such settings...

You might have to restart your ICM after changing the STRUST configuration:

-> Transaction SMICM -> Administration -> ICM -> Exit Soft -> Global -> Yes

I hope this helps.

Best Regards,

Guilherme de Oliveira

Re: resumed SSL session, NO client cert

Former Member — Mon, 25 Nov 2013 19:46:09 GMT

Not all browsers support SSL resume, you might want to try with different browsers as well.

Re: resumed SSL session, NO client cert

JimRadiantExplorer — Tue, 26 Nov 2013 01:13:28 GMT

Hi,

Have you installed client certficate in your browser?

See the following link:

http://wiki.scn.sap.com/wiki/x/VYVXFQ

Thanks.

Jim

Re: resumed SSL session, NO client cert

Former Member — Tue, 26 Nov 2013 05:01:53 GMT

Not yet, initially we have purchase the certificate for our SSL Server Standard from entrust :

CSR sent to entrust and as return they sent ur the 1 root file, 1 chain file and another 1 .pfx file.

Is there any steps how to generate the client certificate? so that i can you this certificate and import it into my browser?

Re: resumed SSL session, NO client cert

Former Member — Tue, 26 Nov 2013 05:07:06 GMT

hi Guilherme,

i check my certificate under SSL System Client SSL Client under strust and there is no self-sign stated over there, with this can i confirm that the Root and Intermediate certificate had already imported into the Client PSE?

Re: resumed SSL session, NO client cert

guilherme_deoliveira — Wed, 27 Nov 2013 12:52:18 GMT

Hello Hariyono,

To improt the certificate response into your PSE, you can follow the wiki page:

http://wiki.sdn.sap.com/wiki/x/qoz_Eg

To import the CA Root certificate into your browser, it depends on the browser itself... In the IE, for example:

IE: Tools -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities -> Import

I hope this clarifies.

Best Regards,

Guilherme de Oliveira