Download of ADSFIPSModule.zip

[former_member1317173]

Since last week I upgraded my Advantage Database Server to version 11.10.0.22 Before that I used for my development the 11.10.0.10 with FIPS.

To test if my software is FIPS complaint. However I cannot find the upgraded FIPS-compliant OpenSSL libraries version 0.9.8zb ADSFIPSModule.zip (libeay32.dll, ssleay32.dll and openssl.exe) for version 11.10.0.22

I downloaded the 51044883.zip file from

https://websmp230.sap-ag.de/sap%28bD1ubCZjPTAwMQ==%29/bc/bsp/spn/download_basket/main.htm?smp-webas=

SAP support site but this hold the old 11.10.0.11 version.

The include ADSFIPSModule.zip only holds the (libeay32.dll and ssleay32.dll).

Openssl.exe is missing which is needed to create a self signed certificate.

On http://devzone.advantagedatabase.com/dz/content.aspx?key=31

The ADSFIPSModule.zip is not present.

When starting ADS Server 11.10.0.22 as a service with the FIPS modules libeay32.dll and ssleay32.dll supported for 11.10.0.10.

It gives an 7165 error.

Where can I download the correct ADSFIPSModule.zip (libeay32.dll, ssleay32.dll and openssl.exe) for version 11.10.0.22?

[HakanHaslaman]

Hello Steven,

To download your requested files direclty from SAP, please follow the description from the ADS Wiki page:

01 - Downloading ADS and generating a validation code - Enterprise Information Management - SCN Wiki

[former_member1317173]

Hello Hakan,

The version that you can download from that location is an old version and does not hold the Openssl.exe which is needed to generate compatible self signed FIPS certificates.

I am looking for the new OpenSSL libraries version 0.9.8zb with Openssl.exe

The licenses I have work on 11.10.0.22 so no need to generate new onces.

Can you make a new package for version 11.10.0.22 and make that available on

the mentioned location?

[HakanHaslaman]

Hello Steven,

I will send this request to the engineering to check and update the file asap.

[Former Member]

Hello Steven,

Looks like you reached a wrong link. Please follow the steps:

1. Go to http://service.sap.com
2. Click on “The SAP Support Portal” link
3. Click the “Download Software” button
4. Choose “Installations & Upgrades”
5. Choose “A-Z Alphabetical List of my Products”
6. Select letter “A”
7. From the list, scroll down and select “SAP ADS”
8. Select the link “SYBASE ADS 11.1”
9. Select link “Support Packages and Patches”
10. Select link “# OS independent” and get your product to download.

From your screenshot it looks like you didn't select the link given in step 9 correctly. Please do not select link "Installation" in step 9, but use the "Support Packages and Patches" link. Then download the second link (highlighted by yellow in the image attached).

This will give you a new set of ADS 11.10.0.22 installers, including a ADSFIPSModule.zip file.

This file contains only the libraries needed by ADS server. Openssl.exe is not included. It can be downloaded from the OpenSSL website.

Let us know if you see any other issues.

[former_member1317173]

With your guidelines I succeeded in downloading ADS111022_0-81000292 object.

This indeed holds the ADSFIPSModule.zip and the adswin_x86_64.exe for version 11.1 SP22

The ADS Server 11.1 SP10 with Client and OpenSSL FIPS module 29-nov-2010 Works!

The ADS Server 11.1 SP22 with Client and OpenSSL FIPS module 1-dec-2014 does not work!

Also it is not possible to generate the self signed certficate using current OpenSSL-1.0.2a

with the 0.9.8zb dlls. Here below the error it generates.

Any ideas on this?

[HakanHaslaman]

Do you use the OpenSSL 1.0.2a for generating the self signed certificate?
If yes, you should use the 0.9.8zb (or the latest version on 0.9.8, but not 1.0.2) OpenSSL tool for this.

Please give them a try and let me know about the result.

[former_member1317173]

For the generation of the self signed certficates I use the 0.9.8p-fips 16 Nov 2010 from Sybase.

At first openssl.exe was included with the ADSFIPSModule.zip

>Parag Mahadane wrote the following

This file contains only the libraries needed by ADS server. 
Openssl.exe is not included. It can be downloaded from the OpenSSL website.

The current version of openssl.exe that I use is not compatible with the dlls supplied with ADSFIPSModule.zip so I still use the old version supplied by Sybase to generate the self signed certificates.

With this openssl and my .cnf I create the

• CLIENT certificate wudbuniv1-CLIENT-CERT.PEM
• SERVER public and private certificate wudbuniv1-SERVER-PUBL-PRIV-CERT.PEM

The ssleay32.dll and libeay32.dll have been copied in the path where ads.exe is installed.

I use Win7-64bit with

• Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
• Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

The certificate is placed at the root D:\

• Launch services.msc
• Click on Advantage Database Server (start manual) with the following
• starting parameters: "/TLSKeyFile D:\wudbuniv1-SERVER-PUBL-PRIV-CERT.pem /TLSKeyPassword <passphrase> /TLSCiphers AES256 /FIPS"

From the client I connect using AdsConnect101 using the following connection string

• TableType=ADT;
• ServerType=REMOTE;
• CommType=TLS;
• LockMode=PROPRIETARY;
• CharType=ANSI;
• SecurityMode=IGNORERIGHTS;
• Data Source=\\udbuniv1\drive_d\;
• TLSCertificate=D:\FIPS\wudbuniv1-CLIENT-CERT.pem;
• TLSCiphers=AES256-SHA;
• TLSCommonName=udbuniv1;
• EncryptionType=AES256;
• FIPS=1;
• TrimTrailingSpaces=FALSE;

With the previous version Advantage the above stuff all works!

Now after installing the new ADS-11.10.0.22 with the new OpenSSL dll's it does not work anymore and gives an fatal error with code 7165?

What am I missing out at?

• Are ssleay32.dll and libeay32.dll compiled with an older version of Visual C++ ?
• It would be really helpfull if OpenSSL.EXE is supplied using the same build as ssleay32.dll and libeay32.dll
• What does 7165 mean? Which is a SAP error.
• Has SAP tested the FIPS on a Win7 64-bit machine with the ssleay32.dll and libeay32.dll?

I have installed all Visual C++ version from 2005, 2008, 2010 but it makes no difference.

[Former Member]

Here is the ADS help file for the 7165 error:

http://devzone.advantagedatabase.com/dz/WebHelp/Advantage11.1/index.html?error_7165_fips_mode_failed...

Can you check your Advantage error logs (ads_err.adt / ads_err.dbf) and see if there are any other errors logged with the 7165 at the same date/time and thread number?  What are these errors?

[former_member1317173]

Here the error messages. Always 3x lines.

-[1]-

DATE          20150521

TIME          22:34:40

THREAD_NUM    4060

ERR_CLASS     7000

ERROR_CODE    7160

ADS_SOURCE    adsfips.c

SRC_LINE      1048

CNNCT_NUM

CNNCT_NAME

FILENAME      Could not load library....0.22\Server\libeay32.dll

ADS_VER       11.10.0.22

ENVIRONMNT    Windows NT

OS_VERSION    6.1

-[2]-

DATE          20150521

TIME          22:34:40

THREAD_NUM    4060

ERR_CLASS     0

ERROR_CODE    7165

ADS_SOURCE    adsfips.c

SRC_LINE      1050

CNNCT_NUM

CNNCT_NAME

FILENAME

ADS_VER       11.10.0.22

ENVIRONMNT    Windows NT

OS_VERSION    6.1

-[3]-

DATE          20150521

TIME          22:34:45

THREAD_NUM    4060

ERR_CLASS     7000

ERROR_CODE    7160

ADS_SOURCE    adsfips.c

SRC_LINE      1048

CNNCT_NUM

CNNCT_NAME

FILENAME      Could not load library....0.22\Server\libeay32.dll

ADS_VER       11.10.0.22

ENVIRONMNT    Windows NT

OS_VERSION    6.1

[Former Member]

Are you certain you copied the libeay32.dll  (and ssleay32.dll) from the WIN64 directory into your ADS 64-bit installation?

I just did a quick test.  that is the exact error I get if I copy in the WIN32 files, but as soon as I replace them with the WIN64 files it works just fine.

[sungur1]

is there a new link available?