Question Re: FIORI Apps blocked due to certificate issue in Technology Q&A

FIORI Apps blocked due to certificate issue

sebastian_bala — Fri, 08 May 2020 11:09:20 GMT

We have the S4/HANA 1809 fully activated instance running since about a year now and ran into some certificate issues lately. After the pre installed certificate run out I created new PSEs as usual using STRUST and we would be fine with the certificate warning of the browsers that the certificates are not trusted but if you try to start an FIORI App it says that the content is blocked due to not trusted/signed certificate and we get a "fatal TLS certificate unknown alert message" in the DEV_ICM trace.

Anyone managed to reinstall trusted certificates on a SAP CAL instance? Or is there a way to open FIORI Apps without a trusted certificate?

Thanks!

Re: FIORI Apps blocked due to certificate issue

JoergWolf — Mon, 11 May 2020 13:17:19 GMT

Hi Sebastian,

if you get the error on port 44301 (i.e. the web dispatcher port) check the following in the web dispatcher console (https://vhcals4hcs.dummy.nodomain:44301/sap/admin/public/default.html , BPINST/Welcome1):

1.) Go to Menu > S4H > Monitor Application Servers.

2.) Check if there is a red error icon in column "Valid (HTTPS)".

3.) If yes, click on the vhcals4hci... button in column Name > Establish Trust > Import the Peer certificate.

This renews the trust relation between web dispatcher and ABAP server and is needed everytime you change the ABAP server certificate in STRUST.

If this doesn't help, please try to access Fiori on port 44300 (direct ABAP port) and post your findings via screenshot here.

Apart from that, there's a medium-difficult way to create a free Let's Encrypt certificate and import it into the appliance if that's an option for you as well. Let me know and we will find a way to provide you some documentation.

Best, Joerg

Re: FIORI Apps blocked due to certificate issue

sebastian_bala — Tue, 12 May 2020 09:19:48 GMT

Hi Jörg,

thank you!!! I searched for days and it is so easy when you know where to look ...

Cheers!

Sebastian

Re: FIORI Apps blocked due to certificate issue

adrian_vaughan — Fri, 15 May 2020 20:09:18 GMT

Hi Joerg, I am interested in the Let's Encrypt certificate installation process ( I have the 1909 CAL instance on GCP) if you can provide details!

Re: FIORI Apps blocked due to certificate issue

JoergWolf — Thu, 02 Jul 2020 18:14:18 GMT

Hi Adrian,

sorry, this slipped through and I just discovered your question by accident (if you still read this):

See this guide (it's also linked from the appliance demo guide page).

Best, Joerg

Re: FIORI Apps blocked due to certificate issue

sebastian_bala — Tue, 18 Aug 2020 07:00:34 GMT

We've got another issue with certificates on our S4/HANA 1809 fully activated. If we try to reach (RFC test) the ADS on the java instance we get still an SSL Trust error. Is there an easy way to fix this like for the web dispatcher?

Will defintly have a look into the guide you posted to install trusted certificates! But looks not like a fast way 🙂

Thanks!

Re: FIORI Apps blocked due to certificate issue

JoergWolf — Mon, 21 Sep 2020 15:06:00 GMT

Hi Sebastian,

we haven't used SSL in the appliance for the ADS RFC connection since the connection to Adobe works without it as well.

I would assume that you can establish the trusted handshake between ABAP and JAVA by importing mutual certificates that you could obtain from a CA. But we haven't tested this.

Best, Joerg