SSL certificate import error

[#1]

Hi, All

We want to use Webdispatcher (on windows) as a reverse proxy with SSL. I generated a request file with command at below

sapgenpse get_pse u2013s 2048 -p C:\usr\sap\FW0\W00\SAPSSLS.pse -r C:\usr\sap\FW0\W00\SAPSSLS.req "CN=portal.xxx.com, OU=xxx company"

sent to an authority and we got a response file.

sapgenpse import_own_cert -c C:\usr\sap\FW0\W00\SAPSSLS.crt -p C:\usr\sap\FW0\W00\SAPSSLS.pse -x pin

when I try to import to webdispatcher, I got an error message

import_own_cert: Sorry, but you didn't supply the filename of the CA Response

any idea

ABH

[blanca_serrano]

Hello ABH,

Can you try including the root certificate with the response ie :

import_own_cert -c <CA-reponse-file> -p <pse> -x <pin> -r <CA Root Cert> -r <CA certificate (intermediate)>

(there maybe an intermediate cert required - check the certificate path by opening the cert in windows and see if one is included as part of the signed certificate) and see if this works.

I hope this helps you.

Regards,

Blanca

[Former Member]

Hi, Blanca

when I double click cert reponse I have popup message "Invalid Public Key Security Object File -- this file is invalid for use as the following : Security Certificate."

which one is CA Root Cert?

thanks

Regards

ABH

[Former Member]

Hello ,

Please check below Prerequisites .

1. You have obtained the SAP Cryptographic Library.

2. The CA root certificate belonging to the issuer of the SAP J2EE Engineu2019s server certificate exists as a file in the file system in Privacy Enhanced Mail (PEM) or DER (binary) format.

And note the below things while setting profile parameters.

1. The parameter wdisp/ssl_cred is only necessary if wdisp/ssl_auth = 2.

2. Use the parameter wdisp/ssl_host if multiple servers in the backend use the same host name in their SSL server certificates (for example, www.mycompany.com).

Thanks

Dheeraj

[Former Member]

Hi, Blanca

I need to import Root and subroot cert too.

import_own_cert -c <CA-reponse-file> -p <pse> -x <pin> -r <CA Root Cert> -r <CA certificate (intermediate)>

solved my problem

Thanks

ABH