Question Re: Importing intermediate Certificate in Technology Q&A

Importing intermediate Certificate

Former Member — Tue, 03 Mar 2009 15:48:31 GMT

We are having issues importing a intermediate certificate from Thawte. We were able to import the Web Server certificate with no problems but when we try the intermediate one it says "no public key can be found."

Has anyone ran into this issue before?

Re: Importing intermediate Certificate

Former Member — Tue, 03 Mar 2009 18:24:37 GMT

Hi,

Where do you want to import this certificate ?

ABAP stack STRUST or Java Stack Visual Admin ?

Which SAP product and release ?

PS : You have to give the context of your question : we cannot guess it !

Regards,

Olivier

Re: Importing intermediate Certificate

Former Member — Tue, 03 Mar 2009 18:26:43 GMT

Sorry should of included that.

We are using sapgenpse to import the certificates that will reside on the SAP Web Dispatcher.

ECC 6.0 is our SAP release.

Re: Importing intermediate Certificate

Former Member — Wed, 04 Mar 2009 08:49:29 GMT

Hi,

Well, I don't know if this info will be useful to it but When I need to configure a signed SSL certificate for a SAP web dispatcher, I use transaction STRUST with option file.

When the signed certificate includes both a root CA and an intermediate CA, I have to extract bith these certificates in base 64 X.509 format and then using a text editor, concatenate the 3 certificates (signed certificate, intermediate CA and root ca) in a single base 64 file. Then I can import susccesfully this file in STRUST in the PSE file that I use for the Web dispatcher.

Tricky, but it works for me !

Regards,

Olivier

Re: Importing intermediate Certificate

Former Member — Wed, 04 Mar 2009 12:26:15 GMT

Ok, so how do you extract them to the base 64 X.509 format?

Below is the command we used:

sapgenpse import_own_cert -p <pse file to use> -c <server certificate> -x <your pin> -r "<root CA certificate>"

Re: Importing intermediate Certificate

Former Member — Wed, 04 Mar 2009 18:19:49 GMT

Hi,

>Ok, so how do you extract them to the base 64 X.509 format?

You just open it from windows (double click), go to the details tab and press the "copy to file" button.

Regards,

Olivier

Re: Importing intermediate Certificate

Former Member — Wed, 04 Mar 2009 18:37:31 GMT

Oh we have the raw certificate code already.

So are you saying take what's between the "Begin / End Certificate" and combine that code into 1 single file and then import?

Re: Importing intermediate Certificate

Former Member — Thu, 16 Apr 2009 13:03:11 GMT

We just solved this by running sapgenpse import_own_cert -p <pse file> -c <certificate file> -r <intermediate file>

Re: Importing intermediate Certificate

Former Member — Wed, 22 Apr 2015 18:29:30 GMT

Hi.

Let me give a bit clearer explanation.

Assuming you have previously setup SSL and HTTPS a Certificate Import is not to hard.

From whoever manages your Certificates they will give you three items.

1. Root Certificate Root-R1.cer

2. Intermediate Certificate gsorgsha2256.cer

3. Self Signed Certificate southern.com.pfx

I upload these to my AIX server in a staged area /SAP/stage/gscerts

Next copy these files to your your SECUDIR as noted below. Run sapgenpse from that area also.

Set your environment (in my case AIX)

setenv SECURDIR /usr/sap/SID/DVMB##/sec (Use the actual values)

setenv SECURDIR /usr/sap/FSB/DVEMB01/sec

You concatenate these 3 files in one string with the following command.

sapgenpse import_p12 -r Root1.cer -r gsorsha2256.cer -p SAPSSLS.pse southern.com.pfx

It will normally ask you for a Pin that was given to you when they sent you the certificates.

This will produce a file called SAPSSL.pse in your /usr/sap/DVMB##/sec directory.

Then you must run a 2nd step to generate a secure logon file.

sapgenpse seclogin -p SAPSSLS.pse -O <SID> adm

Copy the SAPSSLS.pse to your local computer.

Run strustssO2 and import the PSE Key. Point it to your local computer and the SAPSSLS.pse file.

Double Click on the file, it will auto populate the next table.

Then click on 'Add to Certificate List .

Then click on add to ACL. Enter the SID and Instance #.

Save.

You must restart the ICM to get the new key read.

View the ICM trace file to ensure it finds the certificate.

I hope that helps. If you have questions, feel free to ask.