Seeburger AS2 Certificates updates

Dear Experts,
We're having a problem to add in new certificates from our partner. For your info we're using Seeburger AS2 connect and no one knows how to update the certificates including our vendors. Please let me know how to update the certificates. Thank you

Hi,
if you are on PI 7.1x go to Netweaver Administrator (http://server:port/nwa)
Then go to Configuration Management --> Security --> Certificates and Keys
There you shold find several Key Stores ("Key Storage Views")
Select the Keystore which holds the AS2 certificates.
If you are not sure which one is the correct one, check your Sender/Receiver Agreements in the Integration Directory.
The certificates that you specified as TRUSTED\<keystore>\certificate-name in your AS2 configuration are the ones you have to change.
In the "Key Storage View Details" you can add, modify, delete,... the certificates.
regards,
Daniel

Similar Messages

Seeburger AS2 Certificate Issue

Hey,
We are facing an Issue while posting an EDI order to XI.
The sender system receives an error https 403 forbidden.
I assume this is an authorization error.
We had a certificate say XYZ.cert taht expired and hence we uploaded a new certificate say XYZ_1.cert
Now when the sender sends the data, the AS2ID is XYZ and the private key is XYZ.
i would like to know if any of these two values determine the certificate. because if that is the case then the sender data will refer to the old certificate which has expired.
Also if anyone has a different explanation for the error, please mention.
regards,
Milan Thaker

Hi Milan,
If you receiving EDI documents from your partner then in the sender agreement you will specify following certificates
1. Authenticate Certificate - Partner Public Key used to validate the signature of the partner
2.Decryption Key- Your Private Key (your certificate) to decrypt the message
So if you changed your certificate then you need to give your new certificate (public key) to your partner for encrypting.
Regards,
Prakash

Renewing public key certificate used for Seeburger AS2

My general question is when a public key certificate, used for Seeburger AS2 payload decryption and digital signatures, needs to be renewed, how carefully do the certificate renewal steps need to be coordinated for a seamless transition? More specifically...
1. Once we import the CSR response from the CA, will the public key currently used by our partner become invalid, or will it continue to work until its expiration date?
2. Will our partner be able to validate our signature after the new CSR has been imported, but prior to them applying the new public key certificate in their system?
3. Or can we renew the certificate, import the CSR request, provide our partner with the renewed certificate, and let them apply the certificate at their own volition, provided they do it prior to the original certificate expiration?

Hi Kurt
In my experience, the renewal/replacement of AS2 certificates for encryption/decryption & signing/authentication requires coordinated effort on both sides.
This is because AS2 uses asymmetrical encryption, so both parties need to use the same pair of certificates at the same time, i.e. you encrypt on your private key, and partner decrypt on the public key matching your private key. If the keys used do not belong to the same pair, then decryption will not work.
I'm not sure what AS2 software your partner uses and if it has the feature of automatic rollover of certificate, but PI/Seeburger does not. The approach in PI/Seeburger can either be one of the following:-
i) import new cert replacing original cert of the same name
ii) import new cert into new name, manually update sender/receiver agreements
Due to the manual nature of the tasks, normally it requires coordinated effort during a cutover window.
Rgds
Eng Swee

Seeburger AS2 error: No Trusted Certificate found

Dear SAP experts,
Good day!
Need your expert advice regarding the error that I am getting in Seeburger AS2.
Here's the scenario:
SAP XI is sending messages to Trading Partner via AS2 adapter which resides in Seeburger.
I've trigerred already messages but they are getting this kind of error:
Delivery of the message to the application using connection AS2_http://seeburger.com/xi failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # , SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # : javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # , SEEBURGER.
Kindly advice if there are missing or invalid certificates on both sides?
What would be the cause of the issue?
Many Thanks!
Godo

Godo,
I think you are using secure communication for your seeburger CC. Can you pls. check if you have installed(keystore) certifcate on J2EE engine and configured certificate provided by ftp client in your CC.
Also one more important thing,
Make sure that you have entry with ftp server name and correspoding ip address in hosts.inc on a system where your adapter engine resides.
Check detail error messsage at:
http://XI server : port / nwa --> Message Monitoring --> Logs and Trances and select DefaultTrace in second drop down list. You will find all events details with description. ( If you run your interface and check you will find recent activities on XI server. Hope this will give you much better picture)
Hope this will help.
Nilesh

Seeburger AS2 - import certificate type .p7b (PKCS#7)

Dear Seeburger AS2 experts,
Has anyone ever imported (loaded) a certificate file type *.p7b (PKCS#7)? I've got a .p7b certificate file from my trading partner but I cannot import it, as XI does not have the option to load this type. I tried loading a .cer file, but that did not work (as2 authentication error) for some reasons. My trading partner does not have a .p8 or .p12 certificate. Is there any way to load a .p7b into XI?
Thanks.
Sakkarn

Is this resolved...
Regards
Ravi R

Seeburger AS2: How to set up Certificates in PI

Hi ! ALL
We are setting up Seeburger AS2 adapters to exchange file with vendors (B2B).
can you please, share with us ..
1.How to set up certificates, decryption key, signature key.
2.Also, instead of the vendors coming directly to the PI box.....can you share if you have set up any DMZ/firewall environment and how it was set up to talk to PI, especially exchanging certificates.
Your help is greatly appreciated!!
Thank you,
Patrick
Edited by: Patrick Jones on Feb 4, 2009 10:23 PM

Hi Patrick,
For secured communication with business partners you need to implement message level security. You need to create certificates in visual administrator and exchange the public key with your business partner. Also you need to import your business partner public key in visual administrator.
For encryption - Use business partner public key
For signing - Use your private key.
For DMZ check the following help link
http://help.sap.com/saphelp_nw04/helpdata/en/d9/ef2940cbf2195de10000000a1550b0/content.htm
Regards
Prakash

Change of AS2 Certificate

Hi All,
We have a scenario using AS2 adapter which was working fine.
Now the AS2 Certificate has expired and our partner has given us the new certificate and asked us to upload it.
I have changed the Certificate name in all Sender and Receiver agreements in XI ,now I receive this error:
For AS2 receiver:
Error type: COMPONENT_ERROR,NOT_TRANSMITTED >> Error date: 4/17/09 8:22 AM >> Description: AS2 Adapter failure java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no certificate with such alias com.seeburger.as2.AS2Plugin.execute(AS2Plugin.java:321) [4/17/09 8:22 AM]
For AS2 Senders:
Error type: PANIC >> Error date: 4/17/09 6:48 AM >> Description: Initiate Error:com.seeburger.util.configuration.ConfigurationException: Failed to lookup report channel for failed inbound message. Reason : com.seeburger.xi.config.ConfigException: No matching inbound binding (report) found for FromParty: ToParty: subject:SDPACK [4/17/09 6:48 AM]
Kindly let me know what else has to be done at our end.
Thanks.
Regards,
Shweta

Hi Ravi,
This is really a useful information.
We have received a certificate file from our partner as you have mentioned.
I am in contact with BASIS colleague and trying if he could do it.
I would update the thread once it is resolved.
Thanks.
Best Regards,
Shweta

AS2 Certificate Problem

Hi,
I'm doing one IDOC to AS2 Scenario. Where we are posting the IDOC successfully, but we are not able to receive the message.
It is giving some certificate error. Definitely some connectivity issue.
The exact error is :
"Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # , SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found # "
Can someone please tell what exactly can be done to ensure the trusted certificate.
FYI : The SSL certificate in the communication channel and the Encryption certificate and authentication certificate in receiver agreement are all same.
Thanks,
Vikas

HI Vikas,
Can you check the expiry date on the AS2 certificate?
Regards,
ravi

There is no key entry with such alias in keystore seeburger AS2

Hi,
Error message in RWB shows the following
Message entered module processor exit bean and will be transferred to JCA adapter
2011-04-06 06:19:29 Success SEEBURGER/AS2: Received order from system.
2011-04-06 06:19:29 Error Unable to forward message to JCA adapter. Reason: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiExc
2011-04-06 06:19:29 Error Delivery of the message to the application using connection AS2_http://seeburger.com/xi failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.
2011-04-06 06:19:29 Error The message status set to NDLV.
2011-04-06 06:19:29 Error MP: Exception caught with cause javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ks
unable to send / receiver messages through AS2. Please let us know what could be the error. How/ where to resolve it.

Please check the SDN thread below
AS2 Adapter Configuration to Customer / no signature certificate
Also, check the help page below
http://help.sap.com/saphelp_sm40/helpdata/DE/84/be18d66b2a47f6b4adc704a7c0e23e/content.htm
for instructions on how to get the "SEEBURGER EDIINT AS2 Adapter for SAP Exchange Infrastructure Configuration Guide" from the Service Marketplace. Then, on this guide, please check the configuration according to your sender or receiver communication channel regarding the Security (certificates) parameters.
Are the key Store entries imported correctly? Please check if the certificates were imported in the right order and none of the certificates on the chain are expired.

Seeburger AS2 HTTPS receiver channel error

Hi,
I am getting the following error in the receiver Seeburger AS2 channel with HTPS connection and going through a proxy to the Partner.All the certificates have been installed,proxy server information gives,mentioned the key store values and encryption certificate values have been mentioned in the receiver agreement that is using the channel.
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection., SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection.
Can you please give me an idea whether I am missing something or any configuration settings I need to make.
Thank you,
Sri

hi Neetesh,
Thank you for the link.The first thing I have looked at is the link you gave me.But when I give with * it is complaining that it is not able to retrieve the certificates.
TRUSTED/AS2CERTS/*,but I have backward slashes..may be OS is different ,I think the original poste might have Windows servers.
any other ideas please.
thank you.

Com.seeburger.ksm.cryptoapi.exception.CryptoApiException in Seeburger AS2

Hi Experts ,
I am facing some very weird issue of getting below error whenever I try to enable the Encryption in my Receiver AS2 Seeburger Adapter :
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Cannot authenticate the user., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Cannot authenticate the user.
But the moment I send data without signing and encryption it goes well. We have tried placing certificates in receiver agreement and in key store.
Thanks
Abhishek

Prateek ,
Thanks we were able to identify the user to be mentioned but now we are facing below error while using certificates with SH1withRSA Encryption and in receiver channel Encryption algorithm as 3DES :
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm.
The problem doesnt ends here ... while our partner trying to send us data to the URL we have provided its getting 403 Forbidden Error. We have tried resolving the steps which were given in manual but again the sxase is same.
URL : http://server:port/SeeburgerAS2/AS2Server
Any inputs if you can provide on the above 2 errors .
Thanks
Abhishek

SEEBURGER AS2: AS2 Adapter failure -- CryptoApiException: Access Denied.

Hi,
I am trying to send AS2 message to my partner by using Certificates and I am getting the following error at AS2 receiver adapter.Looks like it doesn't have User Credentials to access the certificates.But we provided all the details.We are not sure where it is going wrong.
2008-08-30 14:49:42 Error Unable to forward message to JCA adapter. Reason: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed:com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied.
Can anyone please suggest us what is missing and where it is going wrong?
Regards
Stephano

Hi,
1) First of all create the Seeburger Certificates.
2) You have to deploy those certiates in your Visual Administrator.
After that in Interration Builder -
> Receiver Agreement -
> In Security Settings -
>
                   AS2 Sender Configuration -
> Signing Key -
>give the certificate name over there.
                   AS2 Sender Configuration -
> Encription Certificate & Authenitication Certificate is there
                   u have to give u r certificate names over there.
Thanks,
Satya Kumar

Seeburger AS2: MD5WithRSAEncryption NoSuchAlgorithmException

Hello,
we use a AS2 receiver communication channel with SSL encryption. However when sending out a message we get the following error.
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: MD5WithRSAEncryption, provider: BC, class: org.bouncycastle.jce.provider.JDKDigestSignature$MD5WithRSAEncryption), SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: MD5WithRSAEncryption, provider: BC, class: org.bouncycastle.jce.provider.JDKDigestSignature$MD5WithRSAEncryption)
We already checked that all Java Policy Files have been deployed. We have also tested the adapter successfully.
Any ideas on this?
Thank you!

Hi Florian,
have you checked the following:
-Installation of the Java Cryptography Extension?
-Did you deploy SeeCryptoSourceBridgeLibXI.sda? (Seeburger Certificate Service)
-The Exception "java.io.IOException: java.security.NoSuchAlgorithmException: Error constructing implementation" could also point to a problem in the Keystore:
--> Did you create an Adapter User to access the Keystore?
--> Check if you have set the view_creator role of the keystore you are using to EVERYONE.
--> Maybe your certificate is corrupt?
regards,
Daniel

Client Auth and SSL with Seeburger AS2 adapter

Hello All,
We are using the Seeburger AS2 adapter in our landscape and I am in the process of setting the same up and have made quite some progress in all my issues.
and I hope that you will be able to help me out.
1. Server SSL on Receiver AS2 adapter
I am sending a message from XI using the Receiver AS2 adapter to my AS2 test tool using Server SSL.
This is working perfectly fine. In my AS2 adapter I have selected HTTPS as the protocol and the message goes via SSL to the target test tool, is processed and the MDN comes back to XI perfectly.
The issue here is :
Irrespective of what is provided in the Server Certificate ( Keystore) , the message goes to my target test tool. I even left this field blank with no certificate entry and still the SSL connection was established and the message went to the target system.
Is there no validation that XI does here? I am lost what is the use of this entry Server Certificate if XI blindly accepts all SSL connections.
I am using a Decentral Adapter Engine with LoadBalancer.
2. Client Auth on Receiver AS2 Adapter
I tried to perform Client Authentication by proving my Server's private key in the AS2 adapter. The corresponding public key is loaded in my partner's Keystore.
XI error's with the error "SSL handshake failed - Bad Certificate" .
I am not sure why XI is erroring out here and I have a feeling that I have misunderstood the use of the fields in the AS2 adapter,
Server Certificate ( Keystore) and Private Key for Client Authentication.
Has anyone tried this? If further details are needed, I will be able to furnish the same.
Regards,
Bhavesh

Hello Jens,
Thanks for your reply.
1. The Encryption and Signature part of the Interface is working absolutely fine and I use the same concept highlighted by you - The Sender always signs the message with his private key and encrypts with message with the partner's public key in the corresponding agreement.
2. Server SSL is also working perfectly fine, i.e, when XI initiates the connection the SSL connection is established to the partner.
3. Mutual Auth was the issue where I was getting the bad certificate issue.
To investigate further I moved the same setup to my Central Adapter Engine and all the issues I had described above seem to have vanished and things work exactly as I was expecting, ie.
The field : Server Certificate (Keystore) is used to provide the Target System's Server SSL's public Certificate.
The field : Private Key for Client Authentication is used where XI provides its own Server SSL's private key for Mutual / Client Authentication.
The problem seems to be with my Decentral Adapter engine and not my central adapter engine and so I guess,
1. I either have the incorrect certificates on my Decentral Adapter Engine.
2. I also have 2 instances of a Decentral Adapter Engine with a Webdispatcher and so maybe the 2 Visual Admin's of the 2 Decentral AE are inconsistent.
3. Maybe it was just a long day and I did something wrong
Will investigate further for the root cause but I am glad that my concepts remain intact and things do work as I expected them to work.
A blog on all this is on the cards sometime soon.
Cheers,
Bhavesh

Seeburger AS2 sender comm channel config

Hello,
I have to put in place a scenario for message reicipt of EDI messages via Internet using AS2 on http.
We use the seeburger AS2 adapter.
I try to configure the AS2 sender adapter, but there are many options, which I do not know how to fill, and which aint documented either.
I use the following config:
Tranport Protocol: http
Message Protocol:AS2
Adapter Engine: Integration Server
AS2 Authentification neccessary: When do I have to set this?
Message Title: *
Asynchronous MDN configuration
SSL certificate alias: where do I get this from?
SSL client certificate: what do I put in here?
use proxy: Do I specify the data of our SAP Web dispatcher here?
Thanks
Matthias

HI,
See the below links
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/135b0b94-0701-0010-f6a9-86a14057544a
/people/bla.suranyi/blog/2006/06/08/sap-xi-supports-edifact
/people/william.li/blog/2006/03/17/how-to-get-started-using-conversion-agent-from-itemfield
/people/paul.medaille/blog/2005/11/17/more-on-the-sap-conversion-agent-by-itemfield
http://www.stylusstudio.com/edi/XML_to_X12.html
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/b0b355ae-0501-0010-3b83-8f2bb566fa47
Details on XI EDI adapter from seeburger
Check this for Conversions-
/people/bla.suranyi/blog/2006/06/08/sap-xi-supports-edifact
http://www.seeburger.it/fileadmin/it/pdf/2005_04_sapphire_Ferrero_transcript.pdf
http://www.seeburger.com/fileadmin/com/pdf/Butler_Group_SEEBURGER_Technology_Audit.pdf
http://www.seeburger.com/fileadmin/com/pdf/AS2_General_Overview.pdf
SAP Adapters
EDI with XI
http://www.seeburger.com
http://www.seeburger.com/fileadmin/com/pdf/SEEBURGER_SAP_Adapter_engl.pdf
http://www.sap.com/france/company/events/2006/02-01-Automotive-Seeburger.pdf
http://h41123.www4.hp.com/presentations/ISUG/XISeeBurger.ppt
http://www.sap.com/asia/company/events/nwtechdays/presentation/australia-slides/Pre-Built_Integration.pdf
seeburger adapter configuration
Regards
Chilla

Seeburger AS2 Certificates updates

Similar Messages

Maybe you are looking for