Processing error in ICM when receiving response from WebService

[Former Member]

Hi!

I have configured a scenario which involves consuming a web service over HTTPS.

When trying to test the proxy I get the error: <b>SRT: Processing error in Internet Communication Framework: ("ICF Error when receiving the response: ICM_HTTP_SSL_ERROR</b>.

I have looked for solutions in here, but so far no luck. A lot of similar errors but they are all related to SM59 connection, which is fine in my case.

Looks like it has something to do with my certificate (imported from the web service), but I am not able to figure out what it is...

dev_icm says:

[Thr 5596] Thu May 03 15:39:47 2007
[Thr 5596] *** ERROR during SecudeSSL_SessionStart() from SSL_connect()==SSL_ERROR_SSL
[Thr 5596]    session uses PSE file "C:SAPNSPDVEBMGS00secSAPSSLS.pse"
[Thr 5596] SecudeSSL_SessionStart: SSL_connect() failed --
  secude_error 9 (0x00000009) = "the verification of the server's certificate chain failed"
[Thr 5596] >> ---------- Begin of Secude-SSL Errorstack ---------- >>
[Thr 5596] ERROR in ssl3_get_server_certificate: (9/0x0009) the verification of the server's certificate chain failed 

ERROR in af_verify_Certificates: (27/0x001b) Chain of certificates is incomplete : "OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US"

ERROR in get_path: (27/0x001b) Found root certificate of <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> which does not fit the given PKRoot 

ERROR in verify_with_PKs: (27/0x001b) Found root certificate of <OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US> which does not fit the given PKRoot 

[Thr 5596] << ---------- End of Secude-SSL Errorstack ----------
[Thr 5596]   SSL_get_state() returned 0x00002131 "SSLv3 read server certificate B"
[Thr 5596]   SSL socket: local=192.168.17.106:2950  peer=153.110.169.1:443
[Thr 5596] <<- ERROR: SapSSLSessionStart(sssl_hdl=02946F48)==SSSLERR_SSL_CONNECT
[Thr 5596] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT {00010007} [icxxconn.c 2005]

All help appreciated! Thanks.

regs Ole

[Former Member]

Hi, I am having the same problem, did you solve this issue?

Thanks!.

Mariano Billinghurst.

[brad_bohn]

You're unlikely to get a reply from the creator of such an old post...

The solution to your problem, however, is very simple. You don't have the correct certs loaded in STRUST. The logs will tell which cert is missing; you simply need to check your cert chain in a browser and export/import the missing cert.

[Former Member]

Thanks, I deleted two created but unused PSEs and reloaded the CERTs in the correct PSE and it worked perfectly.

Thank you very much.

Also the aswer will be on this post for the next guy with the same problem 😛

Regards.

Mariano Billinghurst.