RFC SDK / RfcOpenEx / X509CERT Parameter

Question

Hello,
I am trying to connect through the RFC API to an SAP system, which I normally use with my own certificate.
Unfortunately the connection is unsuccessful and I get the following error message back:
     RFC Error Info : Group : 103 Key : RFC_ERROR_LOGON_FAILURE Message : No suitable SAP user found for X.509-client certificate
My implementation is in PHP, but I created an equivalent code snippet in C,
which would have the same meaning:
     1. client_cert contains the certificate of the SAP user.
     2. The connection parameters are as follows:
          ASHOST     = "...sap...system..."
          SYSNR          = "24"
          CLIENT          = "100"
          X509CERT     = client_cert
          GWHOST     = "...sap...system..."
          R3NAME     = "CSS"
          LANG          = "EN"
     handle = RfcOpenEx(connectionParameters);
     if (!handle) {
          printf("Connection failed. Error info: %s", RfcError());
     RfcClose(handle);
As we see from the result, the connection really fails and the error
description sais, that the system cannot find an user with such certificate.
(I should remind you, that I cut off the BEGIN CERTIFICATE and END
CERTIFICATE tags, as well as the white spaces in the certificate. If I don't
do this, I get the message, that the maximum length of the parameter is
exeeded, which now means for me, that the certificate could not be parsed).
I would be very thankful if someone could help me to find the right
solution. Since I don't have any idea what happens after the RFC SDK
library's entry point and in the documentation is not specified in which
format the certificate must be supplied, it is very hard for me to guess
where and what is wrong. The error messages are also not very helpful in my
situation, for I cannot figure out how to proceed.
Thanks in advance for Your help!
Best Regards,
Vasil Bachvarov
SAP

Answer 1

Hi Aleksandra,
if still open, this blog might help Setup data encryption between RFC Client and Web AS ABAP with SNC
The error message sounds like the mapping of X.509 certificate to an ABAP user, using transaction SM30 with VUSREXTID, is probably incorrect, did you check that ? Rule based certificate mapping is also possible, should be even better option, using the transaction CERTRULE_MIG
Hope this helps.
Srdjan