Seeburger - AS2 Certification Public Key Generation

Hi Experts,
I'm not sure if what doing right now after deploying all necessary components for AS2Adapter and BIC adapter is that I can generate an AS2 Certificate from NWA. I just want a guideline on how do AS2 Private Key and Public Key being generated.
I have created an AS2PrivateKey in Keystore. Then it created a public key most likely will be sent to a partner.
Let me know if I'm doing the right thing.
Cheers,
R-jay

R-Jay, it works like this.
You generate the certificate at your end in NWA (as you already did). Now this certificate can be self signed or you can generate a CSR (Certificate Signing Request) based on this certificate. This CSR is sent to certification authority like Verisign. They then provide the certificate which you should share with your partners. If it is only a test, you can skip all this and send the public certificate to partners directly. I am a bit skeptic about this line
"I have created an AS2PrivateKey in Keystore. Then it created a public key "
Both the certificates are created at the same time when you tick option "Store certificate" while creating the certificate.
Regards,
Prateek Raj Srivastava

Similar Messages

Renewing public key certificate used for Seeburger AS2

My general question is when a public key certificate, used for Seeburger AS2 payload decryption and digital signatures, needs to be renewed, how carefully do the certificate renewal steps need to be coordinated for a seamless transition? More specifically...
1. Once we import the CSR response from the CA, will the public key currently used by our partner become invalid, or will it continue to work until its expiration date?
2. Will our partner be able to validate our signature after the new CSR has been imported, but prior to them applying the new public key certificate in their system?
3. Or can we renew the certificate, import the CSR request, provide our partner with the renewed certificate, and let them apply the certificate at their own volition, provided they do it prior to the original certificate expiration?

Hi Kurt
In my experience, the renewal/replacement of AS2 certificates for encryption/decryption & signing/authentication requires coordinated effort on both sides.
This is because AS2 uses asymmetrical encryption, so both parties need to use the same pair of certificates at the same time, i.e. you encrypt on your private key, and partner decrypt on the public key matching your private key. If the keys used do not belong to the same pair, then decryption will not work.
I'm not sure what AS2 software your partner uses and if it has the feature of automatic rollover of certificate, but PI/Seeburger does not. The approach in PI/Seeburger can either be one of the following:-
i) import new cert replacing original cert of the same name
ii) import new cert into new name, manually update sender/receiver agreements
Due to the manual nature of the tasks, normally it requires coordinated effort during a cutover window.
Rgds
Eng Swee

There is no key entry with such alias in keystore seeburger AS2

Hi,
Error message in RWB shows the following
Message entered module processor exit bean and will be transferred to JCA adapter
2011-04-06 06:19:29 Success SEEBURGER/AS2: Received order from system.
2011-04-06 06:19:29 Error Unable to forward message to JCA adapter. Reason: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiExc
2011-04-06 06:19:29 Error Delivery of the message to the application using connection AS2_http://seeburger.com/xi failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.
2011-04-06 06:19:29 Error The message status set to NDLV.
2011-04-06 06:19:29 Error MP: Exception caught with cause javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: There is no key entry with such alias in keystore, SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: java.security.PrivilegedActionException: com.seeburger.ks
unable to send / receiver messages through AS2. Please let us know what could be the error. How/ where to resolve it.

Please check the SDN thread below
AS2 Adapter Configuration to Customer / no signature certificate
Also, check the help page below
http://help.sap.com/saphelp_sm40/helpdata/DE/84/be18d66b2a47f6b4adc704a7c0e23e/content.htm
for instructions on how to get the "SEEBURGER EDIINT AS2 Adapter for SAP Exchange Infrastructure Configuration Guide" from the Service Marketplace. Then, on this guide, please check the configuration according to your sender or receiver communication channel regarding the Security (certificates) parameters.
Are the key Store entries imported correctly? Please check if the certificates were imported in the right order and none of the certificates on the chain are expired.

Client Auth and SSL with Seeburger AS2 adapter

Hello All,
We are using the Seeburger AS2 adapter in our landscape and I am in the process of setting the same up and have made quite some progress in all my issues.
and I hope that you will be able to help me out.
1. Server SSL on Receiver AS2 adapter
I am sending a message from XI using the Receiver AS2 adapter to my AS2 test tool using Server SSL.
This is working perfectly fine. In my AS2 adapter I have selected HTTPS as the protocol and the message goes via SSL to the target test tool, is processed and the MDN comes back to XI perfectly.
The issue here is :
Irrespective of what is provided in the Server Certificate ( Keystore) , the message goes to my target test tool. I even left this field blank with no certificate entry and still the SSL connection was established and the message went to the target system.
Is there no validation that XI does here? I am lost what is the use of this entry Server Certificate if XI blindly accepts all SSL connections.
I am using a Decentral Adapter Engine with LoadBalancer.
2. Client Auth on Receiver AS2 Adapter
I tried to perform Client Authentication by proving my Server's private key in the AS2 adapter. The corresponding public key is loaded in my partner's Keystore.
XI error's with the error "SSL handshake failed - Bad Certificate" .
I am not sure why XI is erroring out here and I have a feeling that I have misunderstood the use of the fields in the AS2 adapter,
Server Certificate ( Keystore) and Private Key for Client Authentication.
Has anyone tried this? If further details are needed, I will be able to furnish the same.
Regards,
Bhavesh

Hello Jens,
Thanks for your reply.
1. The Encryption and Signature part of the Interface is working absolutely fine and I use the same concept highlighted by you - The Sender always signs the message with his private key and encrypts with message with the partner's public key in the corresponding agreement.
2. Server SSL is also working perfectly fine, i.e, when XI initiates the connection the SSL connection is established to the partner.
3. Mutual Auth was the issue where I was getting the bad certificate issue.
To investigate further I moved the same setup to my Central Adapter Engine and all the issues I had described above seem to have vanished and things work exactly as I was expecting, ie.
The field : Server Certificate (Keystore) is used to provide the Target System's Server SSL's public Certificate.
The field : Private Key for Client Authentication is used where XI provides its own Server SSL's private key for Mutual / Client Authentication.
The problem seems to be with my Decentral Adapter engine and not my central adapter engine and so I guess,
1. I either have the incorrect certificates on my Decentral Adapter Engine.
2. I also have 2 instances of a Decentral Adapter Engine with a Webdispatcher and so maybe the 2 Visual Admin's of the 2 Decentral AE are inconsistent.
3. Maybe it was just a long day and I did something wrong
Will investigate further for the root cause but I am glad that my concepts remain intact and things do work as I expected them to work.
A blog on all this is on the cards sometime soon.
Cheers,
Bhavesh

Seeburger AS2 Adapter Error :AUTHENTICATION_ERROR

i am doing the scenario for Purchase Order -> XI ->File
custumer is posting the purchase order
and XI Receives the PO using AS2 Adapter (Seeburger) and sends the output as File
i have done all the AS2 Adapter configurations as mentioned below but still i am getting the error in Seeburger Monitoring, the Error is Authentication_Error
1. Communication chennel
Adapter Type : AS2
Direction : Sender
Transport protocol : HTTP
Message Protocol : AS2
AS2 : Authentication Required is Enabled
Message Subject : Filled which is in Seeburger Monitor
2. Sender Agreement
Sender Communicational chennel which is created above
Security Setting
AS2 Sender Config :
Authentication Certificate : Customer public key
AS2 Receiver Config :
Decryption Key : Private key
3. in Party Identifiers
Party Name
AS2 ID
is there any settings missing to rectify the error "AUTHENTICATION_ERROR"

Hi
Check with PIAPPLUSER authentication
With this Check the following content on AS2 may be you get more clue.
http://www.customware.net/repository/display/WMFAQ/AS2-authenticationfailureinreceivingEDIINT+MDN
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/135b0b94-0701-0010-f6a9-86a14057544a
https://www.sdn.sap.com/irj/sdn/wiki?path=/display/bpxproj/edi%2bwith%2bpi
Handling EDI interfaces using Seeburger BIC modules
Thanks
Gaurav

Seeburger AS2 Verisign

I am attempting to use a Verisign Certificate to secure our communcations with trading partners.
We have generated the key pair, generated a CSR, and had the certificate signed by Verisign.
Curretnly, in the view, is the trading partner certificate, our certificate, the private key, and the verisign_root_08-01-2028 and Verisign_Intermedi_10-24-2016 certificates.
We have provided the trading partner with our certificate.
When sending an outbound message, our channel set to sign, encrypt, and request signed MDN. The encryption key beign the public certificate provided by our trading partner, and the signing key is configured for our private key, and the encryption certificate configured for the trading partners public key. The MDN channel is authentication certificate point to the public key of our trading partner.
When we send a file, the MDN returns:
MDN not authenticated - Error while loading authentication certificate: java.lang.Exception: Authentication certificate alias is empty.
Error in MDN: unexpected-processing-error
Our 'inbound' channels are aso returning errors, with the agreemetns configured to use the correct keys/certificates:
Error while parsing AS2 message: DECRYPTION_ERROR # com.seeburger.ediint.edi.EDIMessageException: message decryption failed: failed to decrypt message: decryption failed: recipientInfo not found for: certificate serial number: 1234567890, certificate issuer: CN=<server name removed>.com,OU=<Witheld>,L=<witheld>,O=<witheld>,ST=Indiana,C=USd"
Notes:
When we tested this using self signed certificates, the scenario worked flawlessly, encryptingm, decrypting, signing and verification of sinatures....flawlesly. Ths complications only arose once we inserted Verisign into the equasion.
What am I missing?

This is an old thread, but if someone gets here searching for: "Authentication certificate alias is empty", like I did:
You can try one of these 2 solutions:
1- Create a parallel channel for MDN (Reports type) with the respective SenderAgreement (http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/d095b2df-9fa3-2d10-568b-d12d99828c33?QuickLink=index&overridelayout=true)
2- Put in Handle Received MDN, on reception channel "Refer MDN to XI System" (https://service.sap.com/sap/support/notes/1442196)
I hope this will help somebody.

Seeburger AS2: How to set up Certificates in PI

Hi ! ALL
We are setting up Seeburger AS2 adapters to exchange file with vendors (B2B).
can you please, share with us ..
1.How to set up certificates, decryption key, signature key.
2.Also, instead of the vendors coming directly to the PI box.....can you share if you have set up any DMZ/firewall environment and how it was set up to talk to PI, especially exchanging certificates.
Your help is greatly appreciated!!
Thank you,
Patrick
Edited by: Patrick Jones on Feb 4, 2009 10:23 PM

Hi Patrick,
For secured communication with business partners you need to implement message level security. You need to create certificates in visual administrator and exchange the public key with your business partner. Also you need to import your business partner public key in visual administrator.
For encryption - Use business partner public key
For signing - Use your private key.
For DMZ check the following help link
http://help.sap.com/saphelp_nw04/helpdata/en/d9/ef2940cbf2195de10000000a1550b0/content.htm
Regards
Prakash

How to get Public Key Remainder?

Hi Friends..
Sorry, i have a little doubt regarding the Public Key Remainder..
What is Public Key Remainder used for?.. is it a part of Public Key?.. How to get it from Public Key, especially in Java?
As far as i know that the Public Key is constructed with Modulus and Exponent, and with this we can Encrypt and Verify data was signed by Private Key..
In Java, we can expose Public Key's modulus and public exponent using RSAPublicKey, there's no method to expose Public Key's Remainder..
Please help me regarding this..
Thanks

Leonardo Carreira wrote:
Hi Shane,
Thanks for your reply.. :)
safarmer wrote:
In that case the exponent and remainder are you public key (exponent and modulus) and the certificate is defined in the definitions section of Book 3. It is a secure way of verifying the public key and it's owner through a trusted certification authority.
EMV Book 3 tends to use Remainder and Modulus interchangeably.You mean, the Issuer (in this case one of E,M, and V) should provide 2 certificates for 1 card?..
This is implemented on SDA or DDA?..
Sorry, i'm still have no idea..
The Remainder and Modulus should be used interchangeably?..
How the Host and Card can decides in each transaction whether it will use Remainder or Modulus?..I mean that the terminology is used interchangeably. They refer to the same thing as far as the actual key is concerned.
Cheers,
Shane

Seeburger AS2 HTTPS receiver channel error

Hi,
I am getting the following error in the receiver Seeburger AS2 channel with HTPS connection and going through a proxy to the Partner.All the certificates have been installed,proxy server information gives,mentioned the key store values and encryption certificate values have been mentioned in the receiver agreement that is using the channel.
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection., SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection.
Can you please give me an idea whether I am missing something or any configuration settings I need to make.
Thank you,
Sri

hi Neetesh,
Thank you for the link.The first thing I have looked at is the link you gave me.But when I give with * it is complaining that it is not able to retrieve the certificates.
TRUSTED/AS2CERTS/*,but I have backward slashes..may be OS is different ,I think the original poste might have Windows servers.
any other ideas please.
thank you.

Com.seeburger.ksm.cryptoapi.exception.CryptoApiException in Seeburger AS2

Hi Experts ,
I am facing some very weird issue of getting below error whenever I try to enable the Encryption in my Receiver AS2 Seeburger Adapter :
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Cannot authenticate the user., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Cannot authenticate the user.
But the moment I send data without signing and encryption it goes well. We have tried placing certificates in receiver agreement and in key store.
Thanks
Abhishek

Prateek ,
Thanks we were able to identify the user to be mentioned but now we are facing below error while using certificates with SH1withRSA Encryption and in receiver channel Encryption algorithm as 3DES :
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm.
The problem doesnt ends here ... while our partner trying to send us data to the URL we have provided its getting 403 Forbidden Error. We have tried resolving the steps which were given in manual but again the sxase is same.
URL : http://server:port/SeeburgerAS2/AS2Server
Any inputs if you can provide on the above 2 errors .
Thanks
Abhishek

SEEBURGER AS2: AS2 Adapter failure -- CryptoApiException: Access Denied.

Hi,
I am trying to send AS2 message to my partner by using Certificates and I am getting the following error at AS2 receiver adapter.Looks like it doesn't have User Credentials to access the certificates.But we provided all the details.We are not sure where it is going wrong.
2008-08-30 14:49:42 Error Unable to forward message to JCA adapter. Reason: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed:com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Access Denied.
Can anyone please suggest us what is missing and where it is going wrong?
Regards
Stephano

Hi,
1) First of all create the Seeburger Certificates.
2) You have to deploy those certiates in your Visual Administrator.
After that in Interration Builder -
> Receiver Agreement -
> In Security Settings -
>
                   AS2 Sender Configuration -
> Signing Key -
>give the certificate name over there.
                   AS2 Sender Configuration -
> Encription Certificate & Authenitication Certificate is there
                   u have to give u r certificate names over there.
Thanks,
Satya Kumar

Seeburger AS2 receiver adapter conf PI 7.1

Dear All,
I have seen a changed AS2 adapter on PI 7.1,the options are totally different than what we have in previous version of AS2 adapter.
I am looking for seeburger AS2 adapter documents and configuration steps for PI7.1 version.
Any inputs...
chirag
Edited by: Chirag Gohil on Sep 8, 2010 5:03 AM

AS2Receiver:
ModuleName: localejbs/ModuleProcessorExitBean
Type: Local Enterprise Bean
Module Key: Exit
-_Module Parameter_-
Module Key: Exit
Parameter Name: JNDIName
Parameter Value: deployedAdapters/SeeXIAS2/shareable/SeeXIAS2
-_Parameters Tab_-
HTTP
Server - Computer with listening AS2 Server
Port - Port of the endpoint with listening AS2 Server
URL Path - Path to the endpoint with listening AS2 server
HTTP Timeout - Timeout in seconds for waiting for server's response
HTTP Keep Alive - If enabled, the HTTP session is re-used. This optimizes the performance.
Basic Authentication
User - User for basic authentication
Password - Password for basic authentication
Realm - Realm for basic authentication
Proxy
Proxy Server - Your proxy server
Proxy Port - The port of the proxy server
Proxy User - User for optional authentication
Proxy Password - Password for optional authentication
Proxy Protocol - Select either - HTTP 1.0 or -HTTP 1.1
AS2
Compress - Select this option if the payload is to be compressed
Sign - Select this if the payload is to be signed
Signing Algorithm - Select an algorithm which is applied for signing the payload; we recommend "SHA-12"
Encrypt - Select this, if the payload is to be encrypted
Encryption Algorithm - Select an algorithm that is used for encrypting the payload; we recommend "RC2/128" or "3DES"
MDN Mode - SYNC to request a synchronous MDN; ASYNC to request an asynchronous MDN; NONE if no MDN is required
Receipt Delivery Address - Enter the URL of the Asynchronous MDNs that are to be delivered (i.e. the URL of your own AS2 server)
MDN Timeout - Enter a time period (in min), after which an outstanding asynchronous MDN will be interpreted as an error. The value "0" means no timeout
Sign MDN - Select this option, if the MDN is to be signed
Message Subject - This text is sent to the server within the optional HTTP header "subject"
Content Type - The content type should be set. A random content type can be set, but we recommend one of the following
= "application/edifact" for EDIFACT files
= "application/edi-x12" for ANSI X.12 files
= "application/xml" for XML files
= "text/plain" for plain text files
= "application/octet-stream" for arbitrary binary files
Delivery transmission report - A special transmission report is delivered to the report channel

Content based receiver determination with Seeburger AS2 adapter

We are planning to use the Seeburger AS2 adapter on our XI 3.0 installation to post custom XML documents to XI from external business partners. The problem we have is to do the receiver and interface determination based on the xml message type that is submitted. How can we identify what is the name of the root xml node (which is representing the message type that was submitted to us) during the receiver determination and specify conditions for the receiver determination based on this? We can not use the Seeburger Classifier module here as this is only determining the mapping name to be used for an EDI conversion but can not handle any type of XML message.

Rudy,
I think the easiest way would still be the ReceiverDetermination and creating an XSD that contains the main important TAGs from the different messages.
That should allow you to test for the existing of certain important TAGs or check the value of some TAGS.
I don´t know about aedaptive-adapters, but I don´t think that they are Drummond-Certified. Check out...
http://www.drummondgroup.com/html-v2/as2-companies.html
Without this certification, a lot of your partners might not allow you to use this adapter if you wanna make AS2 with them.
Greetings
Stefan

Seeburger AS2 Adapter with HTTPS transport

The AS2 adapter is generating the following error.
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection., SEEBURGER AS2: HTTP-Client component init failed # java.security.PrivilegedActionException: com.seeburger.ksm.cryptoapi.exception.CryptoApiException: Could not retrieve alias collection.
According to documentation, the SSL Certificate (keystore) field should point to the keystore, and not a specific key. in my communication channel it does. Thep rivate key points to my key. I have verified both of these entries are correct.
Other than that, this scenario is configured the same as my previously configured scenarios that use HTTP, all working without issue.

Thank you, we had already done that.
What we found however was the entry for the "keystore" in the communication channel, we needed to fully name the key to be used, as opposed to simply the keystore.
Once we did that, we cycled the as2 adapter and were able to send a message successfully.

Seeburger As2 adapter error after upgrade

Hello,
After an upgrade from PI 7.01 to PI 7.11 we have problems with our AS2 seeburger adapter. We installed the compatible version of seeburger but got stuck on the following error:
Message could not be forwarded to the JCA adapter. Reason: Fatal exception: javax.resource.ResourceException: SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm., SEEBURGER AS2: AS2 Adapter failure # java.lang.Exception: AS2 message composition failed: java.io.IOException: org.bouncycastle.cms.CMSException: key inappropriate for algorithm.
Thanks a lot for any advice,
Regards,
Erik

Hi
Pls chk the security jar files. you can download the latest version of these from java portal. This might fix the issues related to Key.
Srikanth Srinivasan

Seeburger - AS2 Certification Public Key Generation

Similar Messages

Maybe you are looking for