PI 7.1 HTTPS Communication

Question

Hi PI Experts,
We are enabling HTTPS communication in PI 7.1 EHP1 using CIDX adapter. We have nearly completed settings after going through several threads and sap help documentation.
1. Defined SSL parameters in RZ10 (ssl/pse_provider = Java and other parameters)
2. Created entry for private key (2048 key length) in ICM_SSL_<instance id> view of key storage in nwa. Generated CSR response, imported CSR response with CA containing private key, intermediate key.
3. Installed Public key of Partner certificate into ICM_SSL_<instance id> and Trusted CAs
4. Exported key to PSE
5. Restarted ICM
Inspite of completing the above configuration and installation of the certificates, still we are not able to complete HTTPS communication. We are facing two issues
(1) For outbound: HTTPException:Padding length error
(2) For inbound: Client is facing issue "HTTP/401 Unauthorized".
What is the service user that is utilized in HTTP communication with certificate logon in PI 7.1? Where do we see this service user? We expect that through nwa>>configuration management>> Identity Management>> for this service user need to apply PI private key and Client public key.
Please provide your inputs for resolution.

Answer 1

Hi Baskar,
Thanks for the reply.
Inbound communication:
We did see this documentation earlier. As per the link, it says "In the Adapter Engine and PCK, only the security role xi_af_receiver of the J2EE component sap.com/com.sap.aii.af.ms.app*MessagingSystem allows the execution of incoming messages.
we strongly recommend that you create separate messaging users with the corresponding role representing individual business systems in a productive environment."
So we created a new user id for the purpose, through NWA Configuration Management>>Authentication, we could able find the policy configuration sap.com/com.sap.aii.af.ms.app*MessagingSystem. For this policy, we need add authentication log in as 'ClientCertLoginModule'. But we do not know how to add/specify this user id against this policy. Though we have added security role xi_af_receive for this user.
In brief we need to specify the server for this policy through certification logon use this new service user id? We want to know where it can be done.
Thanks,
Suraj Pabbathi