SSL handshake failure

Question

Hi,
I have to establish the connection from SAP WebAS to an Apache server via HTTPS.  The Apache authentication is based on client certificates. But I'm still unable to establish a connection. Everything runs fine via HTTPS if client certificate authentication is disabled on Apache (anonymous access). But as soon as client authentication is enabled, the icm log displays the following failure:
[Thr 1800] *** ERROR during SecudeSSL_Read() from SSL_read()==SSL_ERROR_SSL                                                    
[Thr 1800]    session uses PSE file "/usr/sap/E3T/DVEBMGS00/sec/SAPSSLC.pse";;                                                   
[Thr 1800] SecudeSSL_Read: SSL_read() failed --                                                                               
secude_error 536872195 (0x20000503) = "handshake failure"                                                                    
[Thr 1800] >> ---------- Begin of Secude-SSL Errorstack ---------- >>                                                          
[Thr 1800] ERROR in ssl3_read_bytes: (536872195/0x20000503) handshake failure                                                  
WARNING in ssl3_read_bytes: (536875072/0x20001040) received a fatal SSLv3 handshake failure alert message from the peer        
[Thr 1800] << ---------- End of Secude-SSL Errorstack ----------                                                               
[Thr 1800] <<- ERROR: SapSSLRead(sssl_hdl=0x115f8a310)==SSSLERR_SSL_READ                                                       
[Thr 1800] ->> SapSSLErrorName(rc=-58)                                                                               
[Thr 1800] <<- SapSSLErrorName()==SSSLERR_SSL_READ                                                                             
[Thr 1800] *** ERROR => IcmReadFromConn(id=3/1967): SapSSLRead returned (-58): SSSLERR_SSL_READ [icxxthrio_mt 2539]            
[Thr 1800] *** ERROR => IcmReadFromConn(id=3/1967): read failed (rc = -1) [icxxthrio_mt 2611]                                  
[Thr 1800] *** ERROR => IcmHandleNetRead(id=3/1967): IcmReadFromConn failed (rc = -1) [icxxthrio_mt 1304]  
In the Apache logs, it seems that SAP is not sending a client certificate. So Apache closes the connection. Do you have an idea how I can make SAP WebAS send the certificate ?
Thanks in advance
Christan

Answer 1

Hi,
>Because the third line in your log says that no PSE could be found?
I'm not sure of that.
Here is an extract of the log of an ICM starting without a client certificate in STRUST
[Thr 4392] =  secudessl_Create_SSL_CTX():  PSE "D:\usr\sap\PPI\DVEBMGS74\sec\SAPSSLC.pse" not found,
[Thr 4392] =      using PSE "D:\usr\sap\PPI\DVEBMGS74\sec\SAPSSLS.pse" as fallback
[Thr 4392] ******** Warning ********
[Thr 4392] *** No SSL-client PSE "SAPSSLC.pse" available
[Thr 4392] ***    this will probably limit SSL-client side connectivity
[Thr 4392] ********
[Thr 4392] = Success    SapCryptoLib SSL ready!
Here is an extract of the log of an ICM starting with a client certificate in STRUST.
[Thr 9208] =================================================
[Thr 9208] = SSL Initialization  on  PC with Windows NT
[Thr 9208] =   (700_REL,Mar 19 2007,mt,ascii,SAP_UC/size_t/void* = 16/64/64)
[Thr 9208]   SapISSLComposeFilename(): profile param "ssl/ssl_lib" = "I:\usr\sap\DXI\DVEBMGS68\exe\sapcrypto.dll"
           resulting Filename = "I:\usr\sap\DXI\DVEBMGS68\exe\sapcrypto.dll"
[Thr 9208] =   found SAPCRYPTOLIB  5.5.5C pl17  (Aug 18 2005) MT-safe
[Thr 9208] =   current UserID: BT0D0000\SAPServiceDXI
[Thr 9208] =   found SECUDIR environment variable
[Thr 9208] =   using SECUDIR=I:\usr\sap\DXI\DVEBMGS68\sec
[Thr 9208] = Success    SapCryptoLib SSL ready!
Christian,
Could you restart the ICM and check the trace file to find out if you get the message about a missing SAPSSLC.pse ?
Regards,
Olivier
[Thr 9208] =================================================