Certificate based authentication between C4C and CPI

[Former Member]

Hi All,

We are trying to set up the certificate based authentication between HCI and C4C for our BP replication scenario from S/4 On prem to C4C system.

Steps we followed:

1. Downloaded the certificates from HCI- Second Option in the below note

(Followed the note
https://launchpad.support.sap.com/#/notes/0002660023
)

2. Uploaded the certificate in C4C Trust list.

3. In the communication arrangement, we have uploaded the root certificate that was downloaded from step 1

Note: In CPI as well as C4C, authentication type is set to Certificate based.

Now when we send the Business partner from S/4, it reached CPI successfully. But in CPI, we are getting below error message and the message is not reaching C4C.

org.apache.cxf.interceptor.Fault: Could not send Message., cause: org.apache.cxf.transport.http.HTTPException: HTTP response '401: Unauthorized' when communicating with https://myXXXXXX.crm.ondemand.com:443/sap/bc/srt/scs/sap/businesspartnerreplicationin

Please suggest the possible solution.

Regards,

Mohit

[banderson]

Hi Mohit,

Thank you for reaching out to us in the SAP Community.

With the reported error there could be multiple reasons for this problem. Check the below mentioned points, you should be able to identify the problem, usually they are as follows:

1.Customer is not using the correct CPI client certificates.

2.Customer has not uploaded / uploaded incorrect certificates to the inbound communication arrangements in C4C.

3.The CPI client root & intermediate certificate chain are missing in C4C under "Edit Certificate Trust List".

In these instance I would advise you to check the following:

1. Check that the correct CPI client certificates are used in C4C for all inbound communications(to C4C).
The CPI client certificates are part of the CPI provisioning email which customers get when they register for HANA Cloud Platform tenant.

2. CPI Client Certificate's root & intermediate certificate chain are maintained in the certificate trust list of C4C.

3.In Inbound Communication Arrangement, the CPI Client certificate's child certificate is uploaded.

4.The Communicating User is mapped to the certificate in communication certificates in C4C.

If all of the above checks have been carried out , then I would advise you to create an incident with our support team , so they can check this further.

Please use the following structure I have outlined in this Blog when creating the incident :
https://blogs.sap.com/2018/11/21/logging-an-integration-issue-for-your-cloud-for-customer-tenant/

Many Thanks & Best Regards,

Brad