Webdispatcher SSL load balance server mismatch errors

[Former Member]

We are setting up a webdispatcher to access an Enterprise Portal with multiple instances. Currently it is working but we are having to overide host mismatches. in webdispacther log we see

[Thr 4856] Mon Mar 07 11:38:02 2011

[Thr 4856] MatchTargetName("aaa.mycompany.com", "CN=bbb.mycompany.com, OU=xxx, O=ooo, L=ccc, SP=sss, C=US") FAILS

[Thr 4856] SSL NI-sock: local=##.21.13.137:50746 peer=##.21.13.131:51001

[Thr 4856] <<- ERROR: SapSSLSessionStart(sssl_hdl=0000000008565100)==SSSLERR_SERVER_CERT_MISMATCH

The Portal instances are on

aaa.mycompany.com

bbb.mycompany.com

Currently have a CA approved certificate for each server installed in the portal. Dispatcher on aaa uses aaa cert, dispatcher on bbb uses bbb cert.

Message server is on aaa, but it will load balance and place you on either instance.

have following related parameters

wdisp/ssl_encrypt = 2

wdisp/ssl_auth = 2

wdisp/ssl_cred = C:\usr\sap\XXX\W00\sec\XXX.pse

wdisp/ssl_certhost = aaa.mycompany.com

wdisp/ssl_ignore_host_mismatch = TRUE

C:\usr\sap\XXX\W00\sec\XXX.pse has ssl cert of both aaa and bbb servers.

All seems to be working, as users are load balancing. They are not getting certificate mismatches in their browser anymore. We are getting the SSSLERR_SERVER_CERT_MISMATCH errors, but the messages do not seem to cause an issue since we have wdisp/ssl_ignore_host_mismatch set.

Can we eliminate those mismatch errors instead of masking the problem with wdisp/ssl_ignore_host_mismatch?

Should each portal instance have their own ssl cert, or is there a way to use one cert such as the aaa.mycompany.com cert on each portal instance? It seems like that might eliminate the mismatch errors. However, what happens when you go directly to the bbb.mycompany.com portal instance? there is a certificate error if you specify aaa's and you go to bbb. I was wondering if the wdisp/ssl_auth and wdisp/ssl_certhost are valid in the portal system so that each server uses the aaa server and certificate. I could not tell if this parameter is valid for java-only portal systems.

Thanks for your help.

Edited by: Fett Patrick on Mar 7, 2011 8:35 PM

[Former Member]

Hi,

normally, if you have multiple instances for one system then you use same certificate for all instances and specify comon name using wdisp/ssl_certhost. You should be able to use same certificate for common name on each portal instance.

Cheers

[mvoros]

Hi,

normally, if you have multiple instances for one system then you use same certificate for all instances and specify comon name using wdisp/ssl_certhost. You should be able to use same certificate for common name on each portal instance.

Cheers

[Former Member]

Thank you Martin for your prompt reply. Can you clarify please, can we use the wdisp/ssl_certhost parameter in the instance profiles of the portal instances? I wasn't sure if that is only valid for webdispatchers or can also be used in abap/java systems?

We orginally had the aaa server certificate listed for each dispatcher in the portal under ssl provider runtime server identity. That caused a browser "certificate error" when accessing the bbb server. So we then installed an ssl certificate for bbb for its dispatcher. We could then go to either server with no browser "certificate mismatch" error.

Then when we added the webdispatcher, we started getting the server mismatch errors at the webdispatcher level. If the wdisp/ssl_certhost can be used in the portal profiles, then that would hopefully resolve direct access or via web dispatcher aceess mismatches. I.E. only the aaa ssl certificate would be used and parameters would be set at both the webdispatcher and portal profiles

Thanks, Pat.

[mvoros]

Hi,

I am confused. You were getting that mismatch certificate when you were connecting directly or via web dispatcher? That parameter is usable only for web dispatcher and ABAP stack. But as you said you can import any certificate into SSL provider. If you want to have two options then you can try this approach. For port 443 import certificate for each host (aaa will have certificate for aaa and bbb certificate for bbb). You can also define a new port e.g. 4443 which have certificate for host aaa on each instance. Set up web dispatcher to use port 4443 instead of 443. So in case you try to go directly then each instance will use certificate for their server but any user coming from dispatcher will always get certificate only for aaa.

Cheers

[Former Member]

Thanks Martin, that worked. We made all the portal instances use the same ssl certificate. And with certhost specified in the webdispatcher, the mismatch errors are eliminated in the trace log of the webdispatcher. As I noted there is a browser certificate error if you go directly to a application instance from your brower. Instead of doing a second port, which is interesting, we decided we really wanted all access throught he webdispatcher anyway so this is not really an issue since no certificate errors occur.

I do have a question about ljava load balancing that I posted if you have time. They do not seem to work the way i had hoped.