I'm trying to test a SSL connection in SM59 and I keep getting the same error.
[Thr 140434420815632] Wed Jan 5 05:06:36 2011
[Thr 140434420815632] *** ERROR during SecudeSSL_SessionStart() from SSL_connect()==SSL_ERROR_SSL
[Thr 140434420815632] session uses PSE file "/usr/sap/N4S/DVEBMGS01/sec/SAPSSLC.pse"
[Thr 140434420815632] SecudeSSL_SessionStart: SSL_connect() failed --
secude_error 9 (0x00000009) = "the verification of the server's certificate chain failed"
[Thr 140434420815632] >> -
Begin of Secude-SSL Errorstack -
>>
[Thr 140434420815632] ERROR in ssl3_get_server_certificate: (9/0x0009) the verification of the server's certificate chain failed
ERROR in af_verify_Certificates: (12851/0x3233) Verification of one certificate of path failed because there are no basic constraints
ERROR in check_basicConstraints: (12851/0x3233) Verification of one certificate of path failed because there are no basic constraints
ERROR in af_pse_get_PCAList: (4130/0x1022) Object PCAList doesn't exist
ERROR in af_pse_get_FCPath_static: (4130/0x1022) Object FCPath doesn't exist
[Thr 140434420815632] << -
End of Secude-SSL Errorstack -
[Thr 140434420815632] SSL_get_state() returned 0x00002131 "SSLv3 read server certificate B"
[Thr 140434420815632] SSL socket: local=192.168.1.13:51332 peer=17.149.34.134:2195
[Thr 140434420815632] <<- ERROR: SapSSLSessionStart(sssl_hdl=0xea5e30)==SSSLERR_SSL_CONNECT
[Thr 140434420815632] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT [icxxconn_mt.c 2005] It appears that SAP does not like the certificate returned by the called server. Does anyone have any idea how to get around this? Is is possible to add something into STRUST to make this issue go away. I also recorded the test make by SAP via HTTPS. Here is the result. 500 Native SSL error Error: -14 Version: 7000 Component: ICM Date/Time: Wed Jan 5 05:06:36 2011 Module: icxxconn_mt.c Line: 2005 Server: source_N4S_01 Error Tag:
Detail: IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT
Any help would be much appreciated.
Clark Dennison