topic Re: SAP connect to WAS's HTTPs service with mutual authentication in Application Development and Automation Discussions

SAP connect to WAS's HTTPs service with mutual authentication

beta_beta — Wed, 23 Jun 2021 06:32:06 GMT

Hi SAP Expert,

We are configuring the RFC connection in SM59 to connect to the WAS server with HTTPS with

mutual authentication.

SAP had imported the WAS server's root, INTERMEDIATE and private certs,

WAS had import the SAP server's ROOT,INTERMEDIATE and private certs,

In the icm log, we can see

[Thr 772] Certificate verification result:
[Thr 772] Certificate:
[Thr 772] Subject: OID.0.9.*
[Thr 772] Verification result:
[Thr 772] Status: Successful
[Thr 772] DirectlyTrusted: Successful

Then the Server requested client authentication [ssl3_decode_certificate_request], server sent several CA certs,

we can sure the certs are imported into SAP, we had imported them into SSL server and SSL client Standard.

but currently we are facing the issue as below：

[Thr 772] CCL[SSL]: Cli-00000004: Server sent 5 trusted CA name(s) for client authentication [ssl3_decode_certificate_request]
[Thr 772] CCL[SSL]: Cli-00000004: Cannot perform client authentication: Have no certificate fitting to CA names received from server [ssl3_send_client_certificate]
[Thr 772] CCL[SSL]: Cli-00000004: Sending message with empty certificate list [ssl3_send_client_certificate]
[Thr 772] CCL[SSL]: Cli-00000004: Sending empty Certificate message. [tls1_empty_cert_list]

Please help to check the issue, thanks.

Re: SAP connect to WAS's HTTPs service with mutual authentication

Isaias_SAP — Thu, 24 Jun 2021 16:48:36 GMT

Hello,

Use the transaction STRUST to identify what PSE has the correct client certificate, that will be accepted by the remote system for SAP to authenticate itself.

Then, go to the SM59 destination and switch to the "logon & security" tab.

Scroll down, and there you will have the option to choose which client certificate should be used on this destination. Make sure that the correct client PSE is set there.

Regards,

Isaías

Re: SAP connect to WAS's HTTPs service with mutual authentication

beta_beta — Mon, 28 Jun 2021 05:37:51 GMT

Hi,

I have exported web server's certificate and SAP 's certificate, then imported to each other.

In SM59 i am using "SSL client default" , i can sure that the certificate was imported into there.

Re: SAP connect to WAS's HTTPs service with mutual authentication

Isaias_SAP — Mon, 28 Jun 2021 11:36:11 GMT

Hello,

If possible, please upload an ICM level 3 trace captured while simulating the issue.

This should help us identify what is happening.

Regards,

Isaías

Re: SAP connect to WAS's HTTPs service with mutual authentication

beta_beta — Wed, 30 Jun 2021 05:16:48 GMT

Hi Isaias,

Thanks, we have fixed the issue.

We upload the SSL Client standard cert also into the WAS server, then connection is fine.

Re: SAP connect to WAS's HTTPs service with mutual authentication

Isaias_SAP — Wed, 30 Jun 2021 11:20:09 GMT

Hello,

Thank you for sharing the good news! 🙂

Please mark the question as closed 😉

Best regards,

Isaías