SAP Cloud connector HTTPS connection to backend fails

[andreschgz95]

Hello SAP experts.

I'm connecting SCC version 2.11.2 to SAP ERP 6.0 EHP 7 with Netweaver 7.40 SP4. The configuration for HTTP connection works fine as you can see in image below, but not for HTTPS:

This is the configuration in SCC side:

I'm doing this in order to have Principal Propagation enabled, so the SCC system certificate is uploaded in STRUST tcode in ERP side:

The error in ICM trace is the following:

In SCC logs I have the following:

So what I think is that everything in SCC side is working fine, but there is missing configuration in ERP side, maybe related to SSL or TLS.

Do you have some idea of what is going on?

PD: I'm using right HTTPS port and SCC is installed on the same server than ERP is, so it is not a ports issue I think. The mapping rule was successful in CERTRULE tcode

BR.

[andreschgz95 · Accepted solution]

Hello guys.

The problem I had was solved by updating CommonCryptoLib to las version available (8.5.31). The system security library was version 8.4.32 previous to update.

To check update steps you can follow 2450794 - "How to update CommonCryptoLib in a NetWeaver ABAP system".

BR.

Andrés

[andreschgz95]

Hello Markus, thanks for your reply.

I connected SCC version 2.12.3 as you recommended and activated TLS trace. What I can find in ljs_trace.log is the following: ljs-truncated-editedforsapblog.txt

There is also the Audit log from SCC:

I don't see anything wrong in SCC side. On the other hand even when the log entries didn't change on ICM side, there is something that gets me curious about that trace:

Do you think the error may have something to do with this "ERROR during SecuSSL SessionStart"?

Since the error in ljs_trace.log points to "illegal_parameter" I'm thinking maybe it is something related to the activation of TLS1.2 or something like that in ERP side. What do you think about that?

BR.

Andrés Chacón.

ljs-truncated-editedforsapblog.txt

[MarkusTolksdorf]

Hello Andres,
you are right, it might be related to the TLS communication. In order to see more, it is a good idea to create TLS traces on SCC side. With the latest Cloud Connector 2.12.3 this is easily possible in the log and trace configuration. Then you can see whether the ABAP server is really announcing the self-signed system certificate in the list of trusted CAs.

Best regards,
Markus