AS2 Certificate Issue

Hi all,
While loading AS2 certificate of the Trading Partner in our system it is asking for the password to unloack the certificates but when i contacted the Trading Partner they have not set any password for the certificates . Can any one help what could be the issue ?
Thanks
Laks

Can be one of 2 reasons;
1. Your partner has provided you with the private key rather than the public cert. What is the extension of this certificate?
2. There is some enconding issue ; think Xi VA can import only, .cer, .crt and .der files; am not sure though.
Regards
Bhavesh

Similar Messages

Seeburger AS2 Certificate Issue

Hey,
We are facing an Issue while posting an EDI order to XI.
The sender system receives an error https 403 forbidden.
I assume this is an authorization error.
We had a certificate say XYZ.cert taht expired and hence we uploaded a new certificate say XYZ_1.cert
Now when the sender sends the data, the AS2ID is XYZ and the private key is XYZ.
i would like to know if any of these two values determine the certificate. because if that is the case then the sender data will refer to the old certificate which has expired.
Also if anyone has a different explanation for the error, please mention.
regards,
Milan Thaker

Hi Milan,
If you receiving EDI documents from your partner then in the sender agreement you will specify following certificates
1. Authenticate Certificate - Partner Public Key used to validate the signature of the partner
2.Decryption Key- Your Private Key (your certificate) to decrypt the message
So if you changed your certificate then you need to give your new certificate (public key) to your partner for encrypting.
Regards,
Prakash

AS2 Certificate widget scoring issue

I received a fix from someone on the Captivate forum that is supposed to fix the AS2 Certificate widget scoring issue. The results on my Score Results page appear correctly, but the results on the certificate do not match those on the Score Results page. I tried to use the fix the provided (another widget that you insert at the beginning of the project) but it did not solve my problem. I am desperate for a solution to this and have tested the project what feels like 100 times to try to figure out how to fix this problem. I apologize in advance if this has been addressed in another string. I have spent a great deal of time going through the forums and have found some discussion on this issue, but no concrete solution anywhere. Can anyone offer any insight?
FYI: I am using Captivate 4 and my project is set to AS2.
Thanks!

Weird ... I need to ask a totally unrelated question and came to the forum using a link I'd bookmarked ... to the "Certificate Not Widget Scoring Correctly" thread. And here's your post at the top of the list.
I haven't played with scoring in quite awhile, so I'm not much help and maybe you've already read this thread, but just in case: here's the link: http://forums.adobe.com/thread/598503.
Hope it's helpful.

AS2 Certificate Problem

Hi,
I'm doing one IDOC to AS2 Scenario. Where we are posting the IDOC successfully, but we are not able to receive the message.
It is giving some certificate error. Definitely some connectivity issue.
The exact error is :
"Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # , SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # "
Can someone please tell what exactly can be done to ensure the trusted certificate.
FYI : The SSL certificate in the communication channel and the Encryption certificate and authentication certificate in receiver agreement are all same.
Thanks,
Vikas

HI Vikas,
Can you check the expiry date on the AS2 certificate?
Regards,
ravi

Certificate issue for order response messages to Tradeplace

hi,
it appears that you may not even get that message out to us due to a cert issue. In fact it is not finding the cert probably (u201CNo trusted certificate found # nullu201D).
IDoc processed successfully through XI prod but there is error in processing through AS2 (BIS6).
Error : javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found
please advise

Hi,
Ask your BASIS team to check deployed AS2 certificate of your customer on PI Prodcutions server. If this is FIRST AS2 message you are sending to your partner means the AS2 certificate is not yet deployed on PI server. If it is not,The certificate may be expired and that needs renewal. So ask your AS2 partner to provide valid Production AS2 cert. and ask BASIS to deploy the same.
Once valid certificate deployed check your config once and try to resend the message from Adapter engine.
Thanks
Veera

How do i deal with 'security certificate' issues on my iPad2? I'm unable to answer the security questions that pop up when Im trying to download an app because the pop up does not load properly...

Basically my Ipad2 stopped allowing me to go to sites such as Tumblr a little while ago. It wouldn't display the page properly because of 'security certificate' issues. This in itself would not have been such a problem, but when I went to the App store to try and download the Tumblr App, a pop up appeared asking me to answer some security questions before I could successfully install the App. However, the pop up would not display correctly because of 'security certificate' issues and as a result I can't download any apps from the App Store. Can anyone help with this??

Well, I maged to delete some stuff, download the update...
My Mac mail is still not ok. Still only displays today, yesterday and everything is the 16th of the month previous to this?
All a bit strange to say the least any suggestons on how to resolve this.
I now have a second issue in all my emails at the very top of each it describes in detail the full information of
          Delivered-To:
          Received:
          Received:
          Received:
          Received:
          X-Received:
          Return-Path:
          Received-Spf:
          Authentication-Results:
          Content-Type:
          Mime-Version:
          X-Mailer:
          X-Cloudmark-Analysis:
Surely this should not be displayed rather insecure I would think. Any suggestions on how to amend

Certificates issued by communications server for client authentication

Hi,
we ran into problem with those certificates, that are being issued by the lync server itself. In our enteprise we have CX600 and CX3000 phones, and i know that certificate authentication is required for the phones to work (both for registrar and webservice).
However, now that users have lync installed, they have their communications server certificate assigned as well. The problem is when a user needs to sign a document with the certificate from our private CA, for most of the users, word or excel suggests to
use a certificate issued by communications server, not our ent CA. Maybe there is a way for LYNC to trust private enteprise CA and not give out its own certificates and STILL use certificate authentication?
Thanks!

Facing almost the same issue, Lync (server) issues ClientAuth certs from "Communication Server", (btw
is not trusted of course), and in turns forces users to make a selection of which VPN cert to use when dialing in, instead of only one ClientAuth cert installed, they now have 2 ClientAuth certs installed, which our internal CA's should care about and NOT
the Lync (server).
Don’t get how an MS product of this caliber can be built without proper PKI integration, how can it NOT utilize internally issued certs for client authentication???
Not the first though, SCCM and OSD is another example....
However, are you saying that Lync communication can’t be used without certificate authentication,
without the user being spammed with credential prompts?
Trying to get clarification on this…

Change of AS2 Certificate

Hi All,
We have a scenario using AS2 adapter which was working fine.
Now the AS2 Certificate has expired and our partner has given us the new certificate and asked us to upload it.
I have changed the Certificate name in all Sender and Receiver agreements in XI ,now I receive this error:
For AS2 receiver:
Error type: COMPONENT_ERROR,NOT_TRANSMITTED >> Error date: 4/17/09 8:22 AM >> Description: AS2 Adapter failure java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no certificate with such alias com.seeburger.as2.AS2Plugin.execute(AS2Plugin.java:321) [4/17/09 8:22 AM]
For AS2 Senders:
Error type: PANIC >> Error date: 4/17/09 6:48 AM >> Description: Initiate Error:com.seeburger.util.configuration.ConfigurationException: Failed to lookup report channel for failed inbound message. Reason : com.seeburger.xi.config.ConfigException: No matching inbound binding (report) found for FromParty: ToParty: subject:SDPACK [4/17/09 6:48 AM]
Kindly let me know what else has to be done at our end.
Thanks.
Regards,
Shweta

Hi Ravi,
This is really a useful information.
We have received a certificate file from our partner as you have mentioned.
I am in contact with BASIS colleague and trying if he could do it.
I would update the thread once it is resolved.
Thanks.
Best Regards,
Shweta

Checklist for Exchange Certificate issues

Checklist for Exchange Certificate issues
1.
Why certificate is important for Exchange and What are Certificates used for
Exchange is now using certificates for more than just web, POP3, or IMAP. In addition to
securing web services, it has also incorporated Transport Layer Security (TLS) for session based authentication and encryption.
Certificates are used for several things on Exchange Server. Most customers also use certificates
on more than one Exchange server. In general, the fewer certificates you have, the easier certificate management becomes.
IIS (OWA, ECP, EWS, EAS, OA, Autodiscover, OAB, UM)
POP/IMAP
SMTP
2.
Common symptoms for
certificate issue
Here we can see three different types of the certificate warning, mainly from the Outlook
side.
a.
Certificate mismatch issue
b.
Certificate trust issue
c.
Certificate expiration issue
3.
Checklists
In this section, checklists will be provided according to the three different scenarios:
Certificate Mismatch Issue
[Analysis]:
This issue mainly occurs because the URL of the web services Outlook tries
to connect does not match the host name in the certificate.
[Checklist]:
Firstly make sure how many host name in your certificate the certificate. Run “Get-ExchangeCertificate | select certificatedomain”.
Secondly, check the web services URLs which Outlook are trying to connect to. Run “Test Email AutoConfiguration”
In this scenario, you need to check the host name for the following services:
Autodiscover
EWS
OAB
ECP
UM
If any of the urls above does not match the one in the certificate, refer to the following article to change
it via EMS:
http://support.microsoft.com/kb/940726
1.
Do not forget to restart the IIS service after applying the changes above.
2. Make sure a valid certificate is enabled on the IIS service.
Certificate Trust Issue
[Analysis]:
For the self-signed and PKI-based (Enterprise)
certificates, they are not automatically trusted by the client computer or mobile device, you must make sure that you import the certificate into the trusted root certificate store on client computers and devices. On the other hand, Third-party or commercial
certificates do not have this problem. Most commercial CA certificates are already trusted because the certificate already resides in the trusted root certificate store. Because the issuer is trusted, the certificate is also trusted. Using third-party certificates
greatly simplifies deployment.
[Checklist]:
If it’s an Enterprise CA certificate, manually install the root certificate to the “Trusted Root Certification Authorities” folder:
If it is a 3<sup>rd</sup>-party certificate, first remove and reinstall the certificate. Check whether the Windows Certificate Store on the local
client is corrupted. If it still does not work, please contact the third-party CA support to verify the certificate.
Certificate Expiration Issue
[Checklist]:
When a certificate is about to expired, we just need to renew it by referring the following article:
Renew an Exchange Certificate
http://technet.microsoft.com/en-us/library/ee332322(v=exchg.141).aspx
To avoid any conflictions, it’s recommended to remove the expired certificate from the certificate store.
[How to set a reminder to alert the administrator when a certificate is about to expired]:
It’s easy to fix the certificate expire issue. But it should be more important to set a reminder before the
certificate expiration. Or there can be a large user impacts.
Generally, the Event ID “^(24|25)$” will appear in Application log when a certificate is about to expire.
If it’s not quite visible, we can refer to the following solution:
http://blogs.technet.com/b/nexthop/archive/2011/11/18/certificate-expiration-alerting.aspx
OWA certificate revoked issue
[Analysis]:
IE
includes support for server certificate revocation which verifies that an issuing
CA has not revoked a server certificate. This feature checks for CryptoAPI revocation when certificate extensions
are present. If the URL for the revocation information is unresponsive, IE cancels the connection.
[Solution or workaround]:
1. Contact CA provider and check whether the questioned certificate is in the Revoked List.
2. If not, check whether the certificate has a private key.
3. Remove the old certificate and import the new one.
Workaround:
IE Internet Options -> Advanced tab -> Clear the "Check for server certificate revocation"
checkbox.
4.
More References
Digital Certificates and SSL
http://technet.microsoft.com/en-us/library/dd351044(v=exchg.150).aspx
More on Exchange 2007 and certificates - with real world scenario
http://blogs.technet.com/b/exchange/archive/2007/07/02/3403301.aspx

(Reported previous post with link to SIS package to moderator)
This is not the correct SIS package for the N73. The package shown is for S60 3.2 devices, but the N73 is not S60 3.2, I believe it is S60 3.0.
Most features may work with this SIS, but if you experience strange problems, try using the S60 3.0 version.
But there are no significant difference between 2.5.3 and 2.5.5 with regard to attachments. The only changes were with localization (languages).
At this point, try 2.7.0 which is out now:
http://businesssoftware.nokia.com/mail_for_exchange_downloads.php
Make sure to pick the right phone on the drop down list. It does matter! There are 4 different packages. This list makes sure you get the right one.
I have seen some issues with attachments not completing that seem to be carrier dependent. You can test this my using Wifi (if possible).
Message Edited by m4e_team_k on 28-Sep-2008 12:25 AM

CF7 and JDK 1.4.2 - EV SSL Certificate Issue

Let me start off by telling the group that we do not use CF for any of our applications. We are a payments company that hosts a .NET API in IIS that 100's of thousands of customer use. We have one particular customer using CF7 and JDK 1.4.2 who is currently unable to process against our API. About a week ago we upgraded our SSL certificates to EV (Extended Validation) and since that time our once happy customer is now unhappy. I have spent hours working with him, going through FAQs and walk throughs, knowledge bases and forums and have had no luck. Here are the details:
EV Certificate issued by DigiCert (4096-bit).
Customer is on CF7 and JDK 1.4.2.
When he attempts to process against our API with the new certificate he gets 'Connection Failure: Status code unavailable' message from his CF application. He is using cfhttp to post his requests. We found a work around that indicated that the only issue with JDK 1.4.2 was importing the high-bit certificates. Our customer installed JDK 1.6, imported the certificate (and all intermediate certificates) successfully into the cacerts file, but when attempting to list using JDK 1.4.2 is returns an invalid certificate error and still will not work.
Please help as we are currently in a work around state for this customer (not long term) and we have exhausted the resources we have access to for solving this issue.
Thanks in advance to those gurus that reply. I have attached a sample post from our customers logs with non-essential data removed.
I can be reached by phone at 801-341-5620 if anyone feels like reaching out to talk.
- Dave

Dave,
I am having a similar issue with CF7 and PayPal's Reporting API which also uses EV SSL.
I can offer that in my testing, both CF 8 and CF 9 do seem to be able to work when using CFHTTP and EV SSL,
so the only solution I can offer at this time is to make the suggestion to your customer that they need to upgrade
to either CF 8 or CF 9 to get the issue quickly resolved.
I'm still working to see if I can find a solution for CF7 and I've been asking around in the CF community for help, so
if I do find a solution, I'll definitely post it there for you.
Cheers

AS2 Certificate

Can anybody expalin for B2B communication using de-central Adapter Framework how to import AS2 certificate.?

Hello
Just follow these steps:
->Launch the Visual Administrator
->Goto to ServicesKey Storage
->Choose load and select the file containing the certificate (.cer or .crt file)
As the XI configuration will refer to the certificate by name, the name should be somewhat self-describing. The certificate name should not include any date or time.

Seeburger AS2 Certificates updates

Dear Experts,
We're having a problem to add in new certificates from our partner. For your info we're using Seeburger AS2 connect and no one knows how to update the certificates including our vendors. Please let me know how to update the certificates. Thank you

Hi,
if you are on PI 7.1x go to Netweaver Administrator (http://server:port/nwa)
Then go to Configuration Management --> Security --> Certificates and Keys
There you shold find several Key Stores ("Key Storage Views")
Select the Keystore which holds the AS2 certificates.
If you are not sure which one is the correct one, check your Sender/Receiver Agreements in the Integration Directory.
The certificates that you specified as TRUSTED\<keystore>\certificate-name in your AS2 configuration are the ones you have to change.
In the "Key Storage View Details" you can add, modify, delete,... the certificates.
regards,
Daniel

How to fetch certificates issued in past

Hi,
I have a long list of templates issued in my Client's Issuing CA, some of them are not in use. If I try to export " Issued Certificates" list from CA, it hangs.
I want to know how many certificates and last certificate issed from a specific template for fine-tuning and seggregation purpose. Please let me know how we can check that status.
Thanks
Neha Garg

Hi Paul,
I am getting the output like this :
C:\Windows\system32>certutil -view -restrict "certificate template=<1.3.6.1.4.1.
311.21.8.10269956.2688026.1196953.3333800.9810006.227.1092942.575204>"
Schema:
Column Name                   Localized Name                Type    MaxLength
Request.RequestID             Request ID                    Long    4 -- Index
ed
Request.RawRequest            Binary Request                Binary 65536
Request.RawArchivedKey        Archived Key                  Binary 65536
Request.KeyRecoveryHashes     Key Recovery Agent Hashes     String 8192
Request.RawOldCertificate     Old Certificate               Binary 16384
Request.RequestAttributes     Request Attributes            String 32768
Request.RequestType           Request Type                  Long    4
Request.RequestFlags          Request Flags                 Long    4
Request.StatusCode            Request Status Code           Long    4
Request.Disposition           Request Disposition           Long    4 -- Index
ed
Request.DispositionMessage    Request Disposition Message   String 8192
Request.SubmittedWhen         Request Submission Date       Date    8 -- Index
ed
Request.ResolvedWhen          Request Resolution Date       Date    8 -- Index
ed
Request.RevokedWhen           Revocation Date               Date    8
Request.RevokedEffectiveWhen Effective Revocation Date     Date    8 -- Index
ed
Request.RevokedReason         Revocation Reason             Long    4
Request.RequesterName         Requester Name                String 2048 -- In
dexed
Request.CallerName            Caller Name                   String 2048 -- In
dexed
Request.SignerPolicies        Signer Policies               String 8192
Request.SignerApplicationPolicies Signer Application Policies   String 8192
Request.Officer               Officer                       Long
4
Request.DistinguishedName     Request Distinguished Name    String 8192
Request.RawName               Request Binary Name           Binary 4096
Request.Country               Request Country/Region        String 8192
Request.Organization          Request Organization          String 8192
Request.OrgUnit               Request Organization Unit     String 8192
Request.CommonName            Request Common Name           String 8192
Request.Locality              Request City                  String 8192
Request.State                 Request State                 String 8192
Request.Title                 Request Title                 String 8192
Request.GivenName             Request First Name            String 8192
Request.Initials              Request Initials              String 8192
Request.SurName               Request Last Name             String 8192
Request.DomainComponent       Request Domain Component      String 8192
Request.EMail                 Request Email Address         String 8192
Request.StreetAddress         Request Street Address        String 8192
Request.UnstructuredName      Request Unstructured Name     String 8192
Request.UnstructuredAddress   Request Unstructured Address String 8192
Request.DeviceSerialNumber    Request Device Serial Number String 8192
RequestID                     Issued Request ID             Long    4 -- Index
ed
RawCertificate                Binary Certificate            Binary 16384
CertificateHash               Certificate Hash              String 128 -- Ind
exed
CertificateTemplate           Certificate Template          String 254 -- Ind
exed
EnrollmentFlags               Template Enrollment Flags     Long    4
GeneralFlags                  Template General Flags        Long    4
PrivatekeyFlags               Template Private Key Flags    Long    4
SerialNumber                  Serial Number                 String 128 -- Ind
exed
IssuerNameID                  Issuer Name ID                Long    4
NotBefore                     Certificate Effective Date    Date    8
NotAfter                      Certificate Expiration Date   Date    8 -- Index
ed
SubjectKeyIdentifier          Issued Subject Key Identifier String 128 -- In
dexed
RawPublicKey                  Binary Public Key             Binary 4096
PublicKeyLength               Public Key Length             Long    4
PublicKeyAlgorithm            Public Key Algorithm          String 254
RawPublicKeyAlgorithmParameters Public Key Algorithm Parameters Binary 4096
PublishExpiredCertInCRL       Publish Expired Certificate in CRL Long    4
UPN                           User Principal Name           String
2048 -- In
dexed
DistinguishedName             Issued Distinguished Name     String 8192
RawName                       Issued Binary Name            Binary 4096
Country                       Issued Country/Region         String 8192
Organization                  Issued Organization           String 8192
OrgUnit                       Issued Organization Unit      String 8192
CommonName                    Issued Common Name            String 8192 -- In
dexed
Locality                      Issued City
String 8192
State                         Issued State
String 8192
Title                         Issued Title
String 8192
GivenName                     Issued First Name             String 8192
Initials                      Issued Initials               String 8192
SurName                       Issued Last Name              String 8192
DomainComponent               Issued Domain Component       String 8192
EMail                         Issued Email Address          String 8192
StreetAddress                 Issued Street Address         String 8192
UnstructuredName              Issued Unstructured Name      String 8192
UnstructuredAddress           Issued Unstructured Address   String 8192
DeviceSerialNumber            Issued Device Serial Number   String 8192
Maximum Row Index: 0
0 Rows
   0 Row Properties, Total Size = 0, Max Size = 0, Ave Size = 0
   0 Request Attributes, Total Size = 0, Max Size = 0, Ave Size = 0
   0 Certificate Extensions, Total Size = 0, Max Size = 0, Ave Size = 0
   0 Total Fields, Total Size = 0, Max Size = 0, Ave Size = 0
CertUtil: -view command completed successfully.
but it doesnt give me the output that I am looking for. I want to know details of last certificate issued by a given template and its validity status.
Please let me know if I need to make any changes in command.
Thanks
Neha Garg

Clean Access Agent 4.0.5 certificate issue

Dear all,
I ran into an issue that I hope you could help me resolve.
We have NAC 4.0.5 and windows active directory domain.... the clients log on to the client to access the network with their domain credentials and they used to get the "Certificate is issued from an untrusted...." until I installed the www.perfigo.com certificate to the local certificate store...
But as I'm a newbie... I seem to have done something on the NAC manager that messed up something, cause now the client considers the certificate issued from a trusted source, BUT a warning stating that the name on the certificate does not match the name (image attached)..
What would be the possible solution to this??

Hi,
This can happen if you change IP address or hostname of the issued certificate...
Have you done any of these?
As side note, please beaware that 4.0.5 is End of Life since March 16th 2009... so you may want to consider upgrading your setup.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5707/ps8418/ps6128/end_of_life_notice_c51-524732.html.
HTH,
Tiago

When accessing Intranet sites that use SSL Certificates issued by our internal PKI, FF for Windows give an error of "improperly formatted DER-encoded message"

When accessing Intranet sites with that have SSL Certificates issued by our internal PKI, FF for Windows gives an error messsage - An error occurred during a connection to myshaw. security library: improperly formatted DER-encoded message. (Error code: sec_error_bad_der)
Chrome and IE work fine. This is a new PKI using the SHA-2 signature algorithm.

Hi Guigs2,
From the other post you link too, I can confirm that both the Root and Subordinate CA have been commissioned with the:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\CertSvc\Configuration\IssuingCA\CSP\AlternateSignatureAlgorithm = 1
registry key set. As can be seen above, the Signature algorithm on an issued certificate is RSASSA-PSS. This is been Microsoft suggested deployment IF you do not wish to support either XP or Windows 2003 machine and lower. In fact, I believe the option has been around since Windows 2008, however, there were of course, a lot more XP machines back then.
The obvious answer is that we would like to maintain the updated algorithm, AND see support for it added for Firefox. I think you will see a LOT more posts like this as people deploy more 2012 PKI infrastructure supporting only Windows 7 and up. Heavens, we may well be forced to Chrome or even back to IE!!! Whilst I do not what to necessary open up other potential vulnerabilities, for the sake of testing, what do you mean by disabling mozilla:pkix?

AS2 Certificate Issue

Similar Messages

Maybe you are looking for