SOAP Receiver with HTTPS(without certificate)

[Former Member]

Hi experts

Receiver system not using any certificate. Without certificate How PI can send message through HTTPS using SOAP.

How to choose HTTPS transport protocol. (Here Target Url have Https://.....)

Here I am using PI7.1 EHP1.

I configured Receiver SOAP CC as

Transport protocol as HTTP

Taget Url https://api-demo.e-xact.com/transaction

It will work? if not how to enable Https in SOAP receiver

but I am getting below error In adapter

Adapter Framework caught exception: iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier

Thank you

Srini

[former_member4985 · Accepted solution]

Hi Srini,

The main reasons for this error "Peer certificate rejected..." be appearing are the following:

1. The correct server certificate could not be present in the TrustedCA keystore view of NWA. Please ensure you have done all the steps described in the URL below:

Security Configuration at Message Level

http://help.sap.com/saphelp_nwpi711/helpdata/EN/ea/c91141e109ef6fe10000000a1550b0/frameset.htm

2. The server certificate chain contains expired certificate. Check for it (that was the cause for other customers as well) and if it's the case renew it or extend the validation.

3. Some other customers have reported similar problem and mainly the problem was that the certificate chain was not in correct

order. Basically the server certificate chain should be in order Own->Intermedite->Root. To explain in detail, if your server certificate is A which is issued by an intermediate CA B and then B's certificate is issued by the C which is the root CA (having a self signed certificate).

Then your certificate chain contains 3 elements A->B->C. So you need to have the right order of certificate in the chain. If the order is B first followed by A followed by C, then the IAIK library used by PI cannot verify the server as trusted. Please generate the certificate in the right order and then import this certificate in the TrustedCA keystore view and try again. Please take this third steps as the principal one.

4. If the end point of the SOAP Call(Server) is configured to accept a client certificate(mandatory), then make sure that it is configured correctly in the SOAP channel and it is also within validity period.

(This certificate is the one which is sent to Server for Client authentication)

As a resource, you may need to create a new SSL Server key.

The requirement from SAP SSL client side is that the requested site has to have certificate with CN equal to the requested site. I mean if I request URL X then the CN must be CN=X.

In other words, the CN of the certificate has to be equal to the URL in the ftp request. This can be the IP address or the full name of the host.

Request the url with the IP of the SSL Server and the certificate to be with CN = IP of the server.

In any other case the SSL communication will not work.

Regards,

Caio

[deepak_shah]

Hi,

Please refer following thread.

regards,

deepak

[Former Member]

hi,

if the url you posted is the one you try to connect to then it does use a certificate.

you can see that if you put the link in your browser.

that certificate is signed by a certificate authority so you need to have that certificate authority(CA), in this case (it seems like it is goDaddy) in your CA keystore.

[baskar_gopalakrishnan2]

>>> Receiver system not using any certificate. Without certificate How PI can send message through HTTPS using SOAP?

If you are accessing target https system, you need to import certificate of that target system in the netweaver pi keystore.

Your configuration is correct.

You can choose http as transport protocol and use target URL as https://string.

PLease check this thread..