Question Re: SAP Cloud connector HTTPS connection to backend fails in Technology Q&A

SAP Cloud connector HTTPS connection to backend fails

andreschgz95 — Mon, 06 Apr 2020 20:03:26 GMT

Hello SAP experts.

I'm connecting SCC version 2.11.2 to SAP ERP 6.0 EHP 7 with Netweaver 7.40 SP4. The configuration for HTTP connection works fine as you can see in image below, but not for HTTPS:

This is the configuration in SCC side:

I'm doing this in order to have Principal Propagation enabled, so the SCC system certificate is uploaded in STRUST tcode in ERP side:

The error in ICM trace is the following:

In SCC logs I have the following:

So what I think is that everything in SCC side is working fine, but there is missing configuration in ERP side, maybe related to SSL or TLS.

Do you have some idea of what is going on?

PD: I'm using right HTTPS port and SCC is installed on the same server than ERP is, so it is not a ports issue I think. The mapping rule was successful in CERTRULE tcode

BR.

Re: SAP Cloud connector HTTPS connection to backend fails

MarkusTolksdorf — Tue, 07 Apr 2020 07:30:42 GMT

Hello Andres,
you are right, it might be related to the TLS communication. In order to see more, it is a good idea to create TLS traces on SCC side. With the latest Cloud Connector 2.12.3 this is easily possible in the log and trace configuration. Then you can see whether the ABAP server is really announcing the self-signed system certificate in the list of trusted CAs.

Best regards,
Markus

Re: SAP Cloud connector HTTPS connection to backend fails

andreschgz95 — Tue, 07 Apr 2020 21:44:13 GMT

Hello Markus, thanks for your reply.

I connected SCC version 2.12.3 as you recommended and activated TLS trace. What I can find in ljs_trace.log is the following: ljs-truncated-editedforsapblog.txt

There is also the Audit log from SCC:

I don't see anything wrong in SCC side. On the other hand even when the log entries didn't change on ICM side, there is something that gets me curious about that trace:

Do you think the error may have something to do with this "ERROR during SecuSSL SessionStart"?

Since the error in ljs_trace.log points to "illegal_parameter" I'm thinking maybe it is something related to the activation of TLS1.2 or something like that in ERP side. What do you think about that?

BR.

Andrés Chacón.

Re: SAP Cloud connector HTTPS connection to backend fails

andreschgz95 — Wed, 22 Apr 2020 00:59:37 GMT

Hello guys.

The problem I had was solved by updating CommonCryptoLib to las version available (8.5.31). The system security library was version 8.4.32 previous to update.

To check update steps you can follow 2450794 - "How to update CommonCryptoLib in a NetWeaver ABAP system".

BR.

Andrés