Certificate question in Web Dispatcher End-To-End SSL scenario

Hy experts,
in end-to-end SSL scenario the web dispatcher (WD) is not used to encrypt/decrypt data, it is only used to forward requests.
So I think we do need a certificate for the portal server, but none for the web dispatcher itself, right?
Another point is which data should be given for CN, DN, OU etc in this scenario (Portal or WD ??)
kind regards
Tom

Tom,
For end to end SSL you do not need a certificate for the Web dispatcher but your J2EE engine should be configured to be accessible over SSL.
If you get the SSL certificate issued for the J2EE based on the name of the J2EE host it will result in a warning message as portal will be accessed using host name of Web dispatcher, so get the certificate issued under the name of the web dispatcher hostname. So, adjust your CN, DN, OU accordingly.
Cheers!!

Similar Messages

CRM_UI Reporting - HTTPS Terminating at Web Dispatcher or SSL all the way

Hi,
We need to set up access to crm_ui reports (leads and marketing mainly) in CRM 7.0 for vendors coming from the internet. The CRM server is in the internal network. In order for this to work I plan to setup the web-dispatcher in the application dmz. The initial login is going to be via the web dmz layer (using sun's iplanet server), which then routes the crm URL to the web dispatcher in the App dmz and then from the web dispatcher to CRM server.
One requirement from our security team is to set up the flow as HTTPS.
On going through SAP help I get the impression that it can be set up two ways, one, configuring web dispatcher to pass the SSL connection to backend, & two - configuring the web dispatcher to terminate SSL.
Seems the former is quite straight forward (from SAP online help we have to set the icm/server_port_<xx>> = PROT=ROUTER) but does it also require that we setup the crm_ui_frame service as SSL and activate the HTTPS service in ICM?
Or is it better to go via the second option (HTTPS termination) without changing the backend setup? SAP Online help lists steps to do the HTTPS termination but I have not come across any detailed documentation for the first method.
Any thoughts, suggestions will be helpful for either scenario.
Thanks,
Rommel Bhan

Thanks Martin the document helped.
Now the web dispatcher seems to talk to the HTTPS port on the backend.
However there is one issue I see in the dev_webdisp and was wondering if you have an insight.
Based on webdispatcher parameters, its taling to ms_https_port 8533 of backend
[Thr 773] Mon Feb 15 15:03:35 2010
[Thr 773] *** ERROR during SecudeSSL_SessionStart() from SSL_connect()==SSL_ERROR_SSL
[Thr 773] SecudeSSL_SessionStart: SSL_connect() failed --
[Thr 773]   secude_error 9 (0x00000009) = "the verification of the server's certificate chain failed"
[Thr 773] >> -
Begin of Secude-SSL Errorstack -
>>
[Thr 773] ERROR in ssl3_get_server_certificate: (9/0x0009) the verification of the server's certificate chain failed
[Thr 773] ERROR in af_verify_Certificates: (27/0x001b) Chain of certificates is incomplete : "CN=sapcms02.reinternal.com, OU=I0020210975, OU=SAP Web AS, O=SAP Trust Community, C=DE"
[Thr 773] ERROR in get_path: (27/0x001b) Found root certificate of <CN=sapcms02.reinternal.com, OU=I0020210975, OU=SAP Web AS, O=SAP Trust Community, C=DE> which does not fit the given PKRoot
[Thr 773] ERROR in verify_with_PKs: (27/0x001b) Found root certificate of <CN=sapcms02.reinternal.com, OU=I0020210975, OU=SAP Web AS, O=SAP Trust Community, C=DE> which does not fit the given PKRoot
[Thr 773] << -
End of Secude-SSL Errorstack -
[Thr 773]   SSL_get_state() returned 0x00002131 "SSLv3 read server certificate B"
[Thr 773]   SSL NI-sock: local=10.104.146.81:62579 peer=10.104.146.81:8533
[Thr 773] <<- ERROR: SapSSLSessionStart(sssl_hdl=110acb850)==SSSLERR_SSL_CONNECT
[Thr 773] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT [icxxconn_mt.c 1911]
[Thr 773] *** ERROR => IcmConnClientRqCreate() failed (rc=-14) [icrxx_mt.c   5976]
[Thr 773] *** ERROR => Could not connect to SAP Message Server at sapcms02. URL=/msgserver/text/logon?version=1.2 [icrxx_mt.c   3289]
[Thr 773] *** ERROR => rc=-1, HTTP response code: 0 [icrxx_mt.c   3290]
[Thr 773] *** ERROR => see also SAP note 552286 [icrxx_mt.c   3291]
My backend is setup with SSL and web dispatcher is set to the following. Also since the backend and sapweb dispatcher are on the same host, using the same sidadm, the SSL stuff is on one location. I generated the SAPSSLS.pse in the backend using STRUST
Accessibility of Message Servers
rdisp/mshost = sapcms02
ms/http_port = 8100
ms/https_port = 8533
wdisp/server_info_protocol = https
SAP Web Dispatcher Ports
icm/server_port_0 = PROT=ROUTER,PORT=60000
icm/server_port_1 = PROT=HTTPS,PORT=0
icm/server_port_2 = PROT=HTTP,PORT=8080 <-- web dispatcher admin port
#SSL parameters similar to one in backend
ssf/ssfapi_lib = /usr/sap/CMS/SYS/exe/run/libsapcrypto.o
sec/libsapsecu = /usr/sap/CMS/SYS/exe/run/libsapcrypto.o
ssf/name = SAPSECULIB
ssl/ssl_lib = /usr/sap/CMS/SYS/exe/run/libsapcrypto.o
ssl/server_pse=/usr/sap/CMS/DVEBMGS00/sec/SAPSSLS.pse
ssl/client_pse=/usr/sap/CMS/DVEBMGS00/sec/SAPSSLC.pse

Web Dispatcher not doing the load balancing on the portal

Hi Experts
I am having a production issue where the SAP web dispatcher is not doing the load balancing on the portal.
We have ESS/MSS portal with 1 Message server and 2 Application servers. The Web dispatcher is installed on the message server itself. Here is my Web disp profile file
Profile generated by sapwebdisp bootstrap
unique instance number
SAPSYSTEM = 16
add default directory settings
DIR_EXECUTABLE = .
DIR_EXECUTABLE = F:\usr\sap\<SID>\sapwebdisp
DIR_INSTANCE = .
Accessibility of Message Servers
rdisp/mshost = <hostname>.com
ms/http_port = 8111
#Log and Trace
rdisp/TRACE = 2
SAP Web Dispatcher Parameter
wdisp/auto_refresh = 120
wdisp/max_servers = 100
wdisp/shm_attach_mode = 6
configuration as per SAP note 538405
icm/max_conn      = 7000
icm/max_sockets   = 14000
icm/req_queue_len = 6000
icm/min_threads   = 100
icm/max_threads   = 300
mpi/total_size_MB = 500
mpi/max_pipes       = 14000
wdisp/HTTPS/max_pooled_con = 7000
SAP Web Dispatcher Ports
icm/server_port_0 = PROT=HTTP,PORT=8888
SSL
icm/server_port_1 = PROT=ROUTER,PORT=443, TIMEOUT=60
SAP Web Dispatcher Web Administration
icm/HTTP/admin_0 = PREFIX=/sap/wdisp/admin,DOCROOT=./admin,AUTHFILE=icmauth.txt
wdisp/enable_j2ee_groups = TRUE
wdisp/HTTPS/sticky_mask = 255.255.255.255
In my Web dispatcher Admin page, I see all the three application servers, however the requests are going to only 1 App server. We are using ENd to End SSL configuration for the web dispatcher.
We also have a reverse proxy in the landscape and reverse proxy is forwarding all the requests to the Web dispatcher. In Web disp Admin page>Dispatching Module>SSL End to END dispatching, I see only ONE table entry in the dispatching table and it is our Reverse Proxy.
As all the requests are coming from only one source (Reverse proxy), it seems to me that the sap web dispatcher is forwarding those to the same Application server every time.
Can anyone please advise ?
I also tried to configure logon group in NWA, the web dispatcher is detecting the logon group and all the app servers in the logon group. It still not doing the load balancing.
I would greatly appreciate any help.
Thanks
Viny

Vincent, can you please elaborate more ? Is the web dispatcher not able to recognize stateful and stateless application requests ?
I saw that the procedure for configuring SSL Termination on Web dispatcher is long and complicated and looks like SAP web dispatcher needs to have SSL certificate of its own. As we have no ABAP servers and only Java servers, I can not even create the PSEs using STRUST (as described in SAP help -http://help.sap.com/saphelp_nw70ehp1/helpdata/en/48/99c388d7c46bb9e10000000a42189d/frameset.htm
We already have SSL certificates for Java App servers.
I suppose there should be a way for web dispatcher to identify the incoming requests and forward to appropriate application servers.
Any help is much appreciated.
Thanks
Viny

Web Dispatcher and SSL on ABAP+Java

Hello,
Have installed SAP web dispatcher on WAS 6.40 ABAP+Java system. Communicating with Portal SP16 system.
The HTTP works fine. Have not been able to get SSL working with web dispatcher.
For troubleshooting activated ITS on this system and HTTPS works fine with ITS webgui.
Have followed the "how to" SSL for web dispatcher guide.
Also should mention that we have generated certificate requests and PSE's but our organization has not yet chosen a certificate authority to sign the cerficates. For other scenarios (log onto Portal, XI, etc) the only difference is the certifcate warning dialog, otherwise works fine. Would this cause a problem for Web Dispatcher?
Trying the SSL end to end scenario receive
WARNING: Could not start service 0 for protocol HTTPS on host "max-sap" on all adapters
Is there anything
unique for the ABAP+Java configuration?
Thanks,
Alan

I solved this problem by setting the following profile parameter on my webdispatcher profile.
wdisp/ssl_ignore_host_mismatch = true
Doesn't fix the underlying problem but got me going until I can figure it out.

SAP Web dispatcher not forwarding incoming HTTP portal sessions.

Hello,
We are using an EP6 Portal from which Abap Web dynpros are launched. The incoming http sessions were accessing our backend ECC6 SAP system through the sap server message . The http sessions were badly dispatched between the two abap servers. We have been advised by SAP to use the sap web dispatcher instead.
The sap web dispatcher has been correctly installed and configured (on the central abap instance ).
I have carefully read the SAP help section concerning the server selection using the sap web dispatcher :
http://help.sap.com/saphelp_nw04s/helpdata/en/5f/7a343cd46acc68e10000000a114084/frameset.htm
All our settings seem to be OK :
The incoming HTTP requests are forwarded to abap servers only.
*In transaction SICF, all the services under the tree
sap/public/icf_info have been assigned to the same logon group .
The capacity of the two servers included in the logon
group " is the same :
server40 LB=12
server60 LB=12
In the Web interface, capacity equal "1" for the two servers.
wdisp/load_balancing_strategy= weighted_round_robin
In the SAP web interface, the prefered server is ALWAYS the same :
Status of Server Group "LOADIS"
Loadbalancing Information
Number of Servers in this group 2
Last used Server
Preferred next Server server40_SPA_10
But it seems that the sap web dispatcher is not used at ALL.
The Load distribution is still based on the SMLG workload as it was the case, before, with the sap message server. The information displayed in the web interface (preferred server) is wrong.
The Preferred next Server is ALWAYS server40_SPA_10 (shown in the web interface), but, in fact, the http sessions are distributed between the two servers server60_SPA_00 and server40_SPA_10 depending on the server quality diplayed in transaction smlg. It was exactly the same behaviour we had before, only with the sap server message .
Any useful help would be highly appreciated.
Best Regards.

Hi,
firstly, have you checked note 1094342? What variant do you want to use? Do you terminate a SSL connection on web dispatcher and create a new one between web dispatcher and application server? It looks like the web dispatcher can't verify SSL certificate used by application server. Maybe you've already tried this but you can try to turn off SSL between dispatcher and application server. If this setup works then problem is in SSL connection. You can check what host name is used in SSL certificate and what host name is used by dispatcher. You can use parameter wdisp/ssl_certhost which sets host name which will be used for certificate validation.
Cheers

Single Web Dispatcher listening different TCP port

Dear experts,
I would like to post a question regarding Web dispatcher.
Our present environment has a Web dispatcher binding to single domain which is VeriSign Certified. We have received a requirement to support another CA for SSL authentication at Web Dispatcher since VeriSign is not their trusted partner. Hence, i am exploring the below possibilities.
1. Configure another port for SSL with same WD instance. Is this possible?
2. In case point 1 not possible, i will setup another WB instance to listen on differnt TCP port. In this case, is it possible to have two WD binding to single Message Server? The XI version is 7.0.
Appreciate your views and advices.
Thanks in advance.
Regards,
Ravi

This guide will help you undrstand the senario, yes it is possible to have to ports in the kind of senario mentioned in the guide.
https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/60d6de2e-085b-2b10-7a8f-bc9ae1e0bba6
oher info is available at
https://websmp109.sap-ag.de/instguides netveaver->2004s->installation->webdispatcher install guide.
Warm regards,
Dey

Cisco Load balancer and Web Dispatcher to the same portal

Hello Experts,
We have implemented intranet portal with Cisco as the load balancer. Now we need to expose this intranet to the outside world as an extranet portal. So the same portal will be accessed from both intranet and from outside. We are thinking of installing a web dispatcher in the DMZ so that outside users can access the Web Dispatcher URL to access the intranet portal. In effect intranet users will use load balancer and extranet users will use Web Dispatcher to access the same portal. Now my question is if we configure Load Balancer and Web Dispatcher to the same portal, will the portal be able to load balance properly? Is this the right approach?
Thank You,
mansooralip1

Dear Andrew,
We need to provide access to our intranet to some outside companies for them to also use some of our portal applications. As per your answer, I understand that I can configure Web Disptacher to talk to the Cisco Load Balancer of our portal. In this case Web Dispatcher will work just as a reverse proxy. But when I discussed this with one of our basis resource, he told me that when we install and configure Web Dispatcher, it always ask for the Message Server URL and Port number, even if I just want to use Web Dispatcher as a Reverse Proxy. If his concerns are valid, I do not think I will be able to configure Web Dispatcher to access the cisco Load Balancer because I cannot put Cisco load banacer URL and port instead of the Message Server URL and Post Number. Can you kindly share your comment on the same?
Now the second part of my question, if Web Dispatcher cannot be configured to talk to Load Balancer(as mentioned by our basis resource), I will have to use two load balancers. One web Dispatcher in DMZ as a Load Balancer *** Reverse Proxy for the external users. Second the internal Cisco Load Balancer for the intranet users. So the same portal will be accessed by two load balancers. My question here is, in this set up, can the portal work efficieintly here by distributing equal loads two both the server instances?
Thank You,
mansooralip1

Load Balancer and Web Dispatcher "keepalive page"

I would like our monitoring and load balancer to be able to perform http status check against SAP web dispatchers.
Is there a built in "keepalive" page that can be queried within Web Dispatcher, or will a URL rule be needed?

Dear Andrew,
We need to provide access to our intranet to some outside companies for them to also use some of our portal applications. As per your answer, I understand that I can configure Web Disptacher to talk to the Cisco Load Balancer of our portal. In this case Web Dispatcher will work just as a reverse proxy. But when I discussed this with one of our basis resource, he told me that when we install and configure Web Dispatcher, it always ask for the Message Server URL and Port number, even if I just want to use Web Dispatcher as a Reverse Proxy. If his concerns are valid, I do not think I will be able to configure Web Dispatcher to access the cisco Load Balancer because I cannot put Cisco load banacer URL and port instead of the Message Server URL and Post Number. Can you kindly share your comment on the same?
Now the second part of my question, if Web Dispatcher cannot be configured to talk to Load Balancer(as mentioned by our basis resource), I will have to use two load balancers. One web Dispatcher in DMZ as a Load Balancer *** Reverse Proxy for the external users. Second the internal Cisco Load Balancer for the intranet users. So the same portal will be accessed by two load balancers. My question here is, in this set up, can the portal work efficieintly here by distributing equal loads two both the server instances?
Thank You,
mansooralip1

SSL Re-encryption with Portal and Web Dispatcher: certificate expired

Hello,
I am trying to set up HTTPS connection to the Portal through SAP Web Dispatcher. We are using SSL Re-encryption. I think I got everything set up correctly. When trying to access through a Web browser the web dispatcher trace file shows error message 'certificate expired'. Looking at the Portal (Visual admin - Keystore) I am pretty sure it is the service-ssl with localhost. It is expired. Two questions:
- is it correct that it uses localhost or am I missing anything?
- How would I recreate the certificate? (I am sure it is somewhere in the Online documentation, but haven't found it yet). Can I do this while the Portal is productive without breaking the normal access (http) to the Portal. This is our Production portal.
Thanks,
Ingrid

Hi,
Go thru the contents of SAP Note,
685306 -Enabling SSL and renewing the J2EE certificate
And also the help contents in,
http://help.sap.com/saphelp_nw04/helpdata/en/65/6a563cef658a06e10000000a11405a/content.htm
These might of some help to you !
Regards
Srinivasan T

Simple End to End Web service scenario

Hello All,
Can any one please give me a link or basic documents where I can design end to end scenario using HTTP, SOAP adaptors. How to test these scenarios..... I want to build these scnearios using SAP PI Ehp 1
Thanks
Rajeev

Hi,
please do a search first on your own and come back with more detailed questions
thanks,
Regards,
Michal Krawczyk

A question about SAP Web Dispatcher

Following paragraph is copied from TADM10_2 book, Page 39 (Participant Handbok, 2005Q4, 50074912). My question is why there are two same items - ABAP-only scenario? I might be print issue.
The SAP Web Dispatcher can be used for load balancing in the following scenarios:
* Java-only scenario, as described here.
* ABAP-only scenario (see SAP customer training course ADM102, SAP Web AS Administration II)
* ABAP-only scenario (see SAP customer training course ADM102, SAP Web AS Administration II)
Please advise. Thanks so much.
James

HI,
Yes, I think its a print mistake. It should be ABAP Only and Both ABAP and Java Instance.
Rgds
Radhakrishna D S

SAP Web Dispatcher Configuration (SSL, certificates)

Hi all,
We're trying to configure the SAP Web Dispatcher for the use of SSL (terminated) and client authentication using x.509 certificates. All works (almost)fine. However, there's some strange behavior that I can not explain.
The following access point have been specified in the profile:
Description of the Access Points
icm/server_port_0 = PROT=HTTPS, PORT=443, TIMEOUT=15
icm/server_port_2 = PROT=HTTP, PORT=83, TIMEOUT=15
icm/HTTPS/verify_client = 2
Basicly we only need users to access the web dispatcher using SSL. However, when I remove the line: icm/server_port_2 = PROT=HTTP, PORT=83, TIMEOUT=15
The Web Dispatcher returns an error upon accessing it using HTTPS:
Dispatching Error
Error: -26
Version: 6040
Component: HTTP_ROUTE
Date/Time: Tue Mar 14 07:19:38 2006
Module: http_route.c
Line: 2383
Server: sapvm1_DVS_26
Detail: no valid destination server available for '!ALL' rc=13
Any help would be highly appreciated. Thanks!
Frodo

Hi KS,
Maybe you were right afterall I found a nice How to on the servce.sap.com (https://websmp203.sap-ag.de/~form/sapnet?_SHORTKEY=00200797470000073632&_SCENARIO=01100035870000000202) and it seems you do have to add the HTTP server_port parameter in case SSL is being terminated (no re-encryption).
icm/server_port_0 = PROT=HTTPS, PORT=443, TIMEOUT=15
icm/server_port_1 = PROT=HTTP, PORT=0, TIMEOUT=15
However, the trick is to set the port to zero (0), that way you can still only access the Web Dispatcher via HTTPS.
All is working now.
Frodo

Error: Validity of Certificate from list with PSE type PSE ends in 3 da

Hello,
our system is reporting the followin warning
Error: Validity of Certificate from list with PSE type > PSE < ends in 1 days, more notes on system log (SM21)
We check the transaction STRUST and STRUSTSSO2, the certificate between ERP and EP expires today. The ERP system is SAP R/3 Enterprise and EP release is 6.20
Please how can we create the certificate in that releases of SAP ERP and EP, we only found information about this procedure in the newest releases.
Thanks

Hi
Is the SAP Logon certifiacte goiogn to expire??From Portal to ERP??
If this is PSE then follow this [Link.|http://help.sap.com/saphelp_nw2004s/helpdata/EN/a6/f19a3dc0d82453e10000000a114084/frameset.htm]
Regards
Ajay

Certificate Revocation on SAP Web Dispatcher

We have recently set up X.509 Certificate based authentication. The SSL handshake is performed by the Web Dispatcher. Requests are forwarded to SAP Netwewaver 2004s Portal with the certificate in the header field. All of this works "as advertised". Certificates are created by an OpenSSL based CA with the proper extensions and are mapped to UME accounts.
Now we want add the ability to revoke certificates. One reason is, that even if a certificate is no longer mapped to an account, the Portal will still allow the user to log in and use the certificate. The certificate is not stored in the UME, but for the time of the session it looks as if the user did authenticate with a certificate.
We have added the CRL distribtion point extension ot a certificate. We can see that the CRL is downloaded from this site. It shows up in the certificate revocation service page. However, all revoked certificates still work.
The same CRL works correctly on an Apache test server. Here a revoked client certificate will already cause the SSL handshake to fail.
Does it help us to have the CRL installed to the Portal server? Or is it necessary to set up revocation on the Web Dispatcher? Does the Web Dispatcher support certificate revocation at all? If yes, where does it get the CRL from? Does the CRL have to meet certain requirements in addition to the ones defined in RFC 3280?

>
Niels Carstensen wrote:
> OSS ticket is pending.
>
> But if the Web Dispatcher accepted the revoked certificate for the SSL handshake, the Portal will just not authenticate the user. It will, however, allow the user to map the certificate to his account. This even seems to happen, if the CertPersisterLoginModule has been removed from the login stack. So all of a sudden the user can login with username password, and at the same time present the (invalid!) certificate to the applications...
That indeed sounds like a bug - so it was a good idea to submit a support message.
Regards, Wolfgang
PS: I still believe that certificate revocation should be customizable on a per-application level ("application" in this context refers to "usage type": the same certificate might be used for different purposes: SSO, digital signature, encryption, S/MIME, ...). Furthermore, some of the certificate revocation mechanisms have a negative performance impact so they might be used with care. Take the payment card validation as an example: depending on the purchase amount you might be prompted for an online validation (requires to enter your PIN) and sometimes you simply need to sign-off a piece of paper - the decision is up to the shop operator and depends on the related costs (for online validation) which is comparable to "performance impacts" in our case).

Using existing SSL Certificate for Web Dispatcher

Hi,
We've registered a SSL certificate with wildcard option via GlobalSign. The history of this process is as below:
1. We created a Certificate Request with IIS and send it to GS (GlobalSign).
2. They send us the certificate file Globalsign Primary Secure Server CA and Globalsign Server Sign CA files.
3. Import all ceritifcates into IIS and then exported the certificate into a Cert.pfx file.
4. By using this file, we are able to import the SSL certificate into J2EE WAS 640 of Portal system.
5. Now we want to use same certificate to establish a web dispatcher installation as intermediate server for internet access.
Web Dispatcher documentations says to create a pse and req file with sapgenpse program and then send it to CA (here globalsign) to get a certificate.
But when we asked GS, they told us to use the certificate they send us before. They cannot create a certificate file for the ourput of web dispatcher. It will be billed us if we persist.
So, we have to find a way to use the existing certificate to enable SSL of Web Dispatcher.
Any idea?

Hi Huseyin,
I also have the same scenario. We also want to use the same certificate from verisign for our webdispatcher.
Do you know how to do. Can you help me.
Thanks and Regards,
Sailesh K

Certificate question in Web Dispatcher End-To-End SSL scenario

Similar Messages

Maybe you are looking for