HTTPS Communication

[Former Member]

I am facing a problem while trying to acces HTTPS site after configuring HTTP port and ssl.

The error message that we get in the SMICM trace logs when we test from SM59 is like this.

session uses PSE file "E:\usr\sap\R3D\DVEBMGS00\sec\SAPSSLABCDE.pse" SecudeSSL_SessionStart: SSL_connect() failed

secude_error 9 (0x00000009) = "the verification of the server's certificate chain failed"

>> Begin of Secude-SSL Errorstack >>

[Thr 3548] ERROR in ssl3_get_server_certificate: (9/0x0009) the verification of the server's certificate chain failed #

ERROR in af_verify_Certificates: (27/0x001b) Chain of certificates is incomplete :

ERROR in get_path: (27/0x001b) Found root certificate , CN=, OU=Certi

ERROR in verify_with_PKs: (27/0x001b) Found root certificate of << End of Secude-SSL Errorstack SSL_get_state() returned 0x00002131 "SSLv3 read server certificate B"

SapSSLSessionStart(sssl_hdl=0609CED0)==SSSLERR_SSL_CONNECT

We need to do this very urgently.

Pls Help,

Ramana

[Former Member]

Hi,

I haven't had this problem myself so I'm only guessing.

But the error message states that the certification chain could not be verified. In my opinion this means that the server's certificate isn't signed by any authority known to the client.

Could it be that you are using a self-signed certificate for the server - as is often the case with test-environments? If so, the client maybe tries to verify the certificate against known CAs (Thawte, VeriSign,...), but fails.

Regards, Joerg

[eddy_declercq]

I looks very simular to the probs I had. Is your cert CA'ed and is the CA incorporated in your PSE? Have also a look at /people/eddy.declercq/blog/2005/06/14/it146s-a-matter-of-trust and note 510007

[Former Member]

Hi ,

Thanks for your replies . It hepled us in moving in the right direction .

Ramana