The SAPControl certificate is not trusted for the host

Hi Guru's,
While doing the java support package installation i'm stuck on the second step itself stating that "An error has occurred during the execution of the configure SAP Control Connection for central instance step."
"The SAPControl service Certificate is not trusted for the host..."
We have used the latest SUM and its support package level..
PFA Screens
Can you please give the solution for the same. Early reply must be appreciated...
Thanks & Regards,
Prasad Deshpande

Hello Prasad,
You can also avoid the use of SSL in sapcontrol with this workaround:
Open a jump_config.txt file contained in the \usr\sap\SUM\sdt\param directory
Edit the last parameter value (/sapstartsrv/httpsconnection) from true to false and execute the step again.
Please refer to the following link Re: SUM tool error regarding sapcontrol service for further information.
Edit: the SUM guide mentions this behavior as explained by Yves KERVADEC in his post (Re: SUM tool error regarding sapcontrol service).
Best regards,
Nicolas

Similar Messages

Renewed my subca now I get A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider

Hello
My subca certificate was about to expire so I renewed it with the same key and since then my wireless will not connect. I get the following error from NPS:
Network Policy Server denied access to a user.
Contact the Network Policy Server administrator for more information.
User:
Security ID:
AD\4411CB8CD34A2AA$
Account Name:
host/4411CB8CD34A2AA.ad.***.org
Account Domain:
AD
Fully Qualified Account Name:
AD\4411CB8CD34A2AA$
Client Machine:
Security ID:
NULL SID
Account Name:
Fully Qualified Account Name:
OS-Version:
Called Station Identifier:
f4-1f-c2-e6-0e-40:***-private
Calling Station Identifier:
e0-06-e6-c2-96-b7
NAS:
NAS IPv4 Address:
10.0.2.85
NAS IPv6 Address:
NAS Identifier:
DOM-WLC1
NAS Port-Type:
Wireless - IEEE 802.11
NAS Port:
13
RADIUS Client:
Client Friendly Name:
NPS Proxy 1
Client IP Address:
10.0.2.12
Authentication Details:
Connection Request Policy Name:
Wireless Clients
Network Policy Name:
Wireless Clients
Authentication Provider:
Windows
Authentication Server:
DOM-DC1.ad.****.org
Authentication Type:
EAP
EAP Type:
Microsoft: Smart Card or other certificate
Account Session Identifier:
Logging Results:
Accounting information was written to the local log file.
Reason Code:
295
Reason:
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
How do i make the policy provider trust this new certificate that was created? When i renewed the certificate everything looks good on the subca and root ca. The new certificate is not in the nps servers so i tried manually importing it and that still did
not work. I noticed when i open the wireless network policy properties under constraints and open the Microsoft: Smart Card or other certificate eap type the new certificate is not in there. Any suggestions? Thank you!

can you copy client certificate to NPS server and run the following command against this certificate:
certutil -verify -urlfetch path\clientcert.cer
and show us the output.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

W2012R2 - A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.

Hi all.
I have stanalone offline RootCA, and enterprise domain SubCA on DC on Windows 2012 server. I have Windows 2003 Terminal Server, users logon to TS via smart cards - and this work fine.
Now I added Windows server 2012 as "Terminal Server".
Now I added Windows server 2012 R2 as "Terminal Server".
I configured both servers identically.
Users can logon via smart card to Windows Server 2012.
Users CAN NOT logon via smart card to Windows Server 2012 R2.
When user trying to logon via smart card, they have information:
"An untrusted cartification authority was detected while processing the domain controller certificate used for authentication. Additional information..."
I run a certutil.exe -scinfo on both Windows 2012/2012R2 servers.
I found differences in the (~) same place in the output log.
On Windows 2012:
Exclude leaf cert:
   b4 44 8f fb fb b4 5f 03 39 76 dc cc e8 da 02 e0 d0 cc b6 32
Full chain:
   c8 3d 07 12 ea 4d 0e 5a 8c 50 fc 56 2e 51 f1 68 6a 26 90 77
Verified Issuance Policies: None
Verified Application Policies:
     1.3.6.1.5.5.7.3.2 Client Authentication
     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
On Windows 2012 R2:
Exclude leaf cert:
   78 7e 6c 60 3f 20 c6 f6 e8 74 c8 36 e3 d3 88 ac 12 60 41 32
Full chain:
   b8 a9 fa 6c db 07 cd 32 86 17 8c 88 02 ba d0 4b 8c ac 2d 58
   Issuer: CN=XXX CA, OU=Certification Services, O=XX, C=XX
   NotBefore: 2013-11-22 12:42
   NotAfter: 2014-11-22 12:42
   Subject: CN=XX Test, OU=XX, OU=UXX, DC=XX, DC=com
   Serial: 7a0084f
   SubjectAltName: Other Name:Principal Name=XX@XX
   Template: Smartcard Logon Behalf 2048
   1d 2a bb dc 2a 9c 70 0d b5 35 47 44 ee 61 60 ab 71 97 66 ff
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478)
I run a certutil -verify xx.cer on both Servers 2012/2012R2 and on both servers have the ~exact same thing.
Windows 2012:
Exclude leaf cert:
   f6 0e 96 da c7 08 9a 78 12 97 a6 b6 22 df 57 9d e7 03 41 df
Full chain:
   f0 fb 19 66 e8 6c 4f ea b4 d5 ea 6d 5e 38 54 07 b0 9f 52 96
Verified Issuance Policies: None
Verified Application Policies:
     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
     1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
Windows 2012 R2:
Exclude leaf cert:
   84 18 5b 9d 06 61 60 73 c6 37 80 f4 25 33 c4 d3 5e ef 4a 93
Full chain:
   63 8e 9e 37 78 c9 93 bb 4d da f4 e3 4b 7e 2b 14 49 28 0f 5d
Verified Issuance Policies: None
Verified Application Policies:
     1.3.6.1.4.1.311.20.2.2 Smart Card Logon
     1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
Whether Windows 2012R2 is not trying to build a certificate path, treating smart card logon certificate as (Sub)CA certificate?
Previous and probably wrong idea:
The only thing that comes to my mind is my SubCA.
I have two CA Certyficates:
Certyficate #0 (expired)
Certyficate #1 <- valid.
I guess that all Windows before Windows 2012 R2 build certyficafion chain from valid (second #1) certyficate. Windows 2012 R2 take first and we have:
"A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
[ value] 800B0112 "
This is a bug or feature?
How I can fix this without removal Certificate #0 from my SubCA?
Best regards
Jacek Marek
MCSA Windows Server 2012

Hi,
Glad to hear that the issue is solved!
Thank you very much for your sharing!
Please feel free to let us know if you encounter any issues in the future.
Best Regards,
Amy

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.

Hi all.
I have stanalone offline RootCA, and enterprise domain SubCA on DC on Windows 2012 server. I have Windows 2003 Terminal Server, users logon to TS via smart cards - and this work fine.
Now I added Windows server 2012 as "Terminal Server".
Now I added Windows server 2012 R2 as "Terminal Server".
I configured both servers identically.
Users can logon via smart card to Windows Server 2012.
Users CAN NOT logon via smart card to Windows Server 2012 R2.
When user trying to logon via smart card, they have information:
"An untrusted cartification authority was detected while processing the domain controller certificate used for authentication. Additional information..."
The only thing that comes to my mind is my SubCA.
I have two CA Certyficates:
Certyficate #0 (expired)
Certyficate #1 <- valid.
I guess that all Windows before Windows 2012 R2 build certyficafion chain from valid (second #1) certyficate. Windows 2012 R2 take first and we have:
"A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
   [ value] 800B0112 "
This is a bug or feature?
How I can fix this without removal Certificate #0 from my SubCA?
Best regards
Jacek Marek
MCSA Windows Server 2012

Hi,
I run a certutil.exe -scinfo on both Windows 2012/2012R2 servers.
I found differences in the (~) same place in the output log.
On Windows 2012:
Exclude leaf cert:
b4 44 8f fb fb b4 5f 03 39 76 dc cc e8 da 02 e0 d0 cc b6 32
Full chain:
c8 3d 07 12 ea 4d 0e 5a 8c 50 fc 56 2e 51 f1 68 6a 26 90 77
Verified Issuance Policies: None
Verified Application Policies:
    1.3.6.1.5.5.7.3.2 Client Authentication
    1.3.6.1.4.1.311.20.2.2 Smart Card Logon
On Windows 2012 R2:
Exclude leaf cert:
78 7e 6c 60 3f 20 c6 f6 e8 74 c8 36 e3 d3 88 ac 12 60 41 32
Full chain:
b8 a9 fa 6c db 07 cd 32 86 17 8c 88 02 ba d0 4b 8c ac 2d 58
Issuer: CN=XXX CA, OU=Certification Services, O=XX, C=XX
NotBefore: 2013-11-22 12:42
NotAfter: 2014-11-22 12:42
Subject: CN=XX Test, OU=XX, OU=UXX, DC=XX, DC=com
Serial: 7a0084f
SubjectAltName: Other Name:Principal Name=XX@XX
Template: Smartcard Logon Behalf 2048
1d 2a bb dc 2a 9c 70 0d b5 35 47 44 ee 61 60 ab 71 97 66 ff
A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478)
I run a certutil -verify xx.cer on both Servers 2012/2012R2 and on both servers have the ~exact same thing.
Windows 2012:
Exclude leaf cert:
f6 0e 96 da c7 08 9a 78 12 97 a6 b6 22 df 57 9d e7 03 41 df
Full chain:
f0 fb 19 66 e8 6c 4f ea b4 d5 ea 6d 5e 38 54 07 b0 9f 52 96
Verified Issuance Policies: None
Verified Application Policies:
    1.3.6.1.4.1.311.20.2.2 Smart Card Logon
    1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
Windows 2012 R2:
Exclude leaf cert:
84 18 5b 9d 06 61 60 73 c6 37 80 f4 25 33 c4 d3 5e ef 4a 93
Full chain:
63 8e 9e 37 78 c9 93 bb 4d da f4 e3 4b 7e 2b 14 49 28 0f 5d
Verified Issuance Policies: None
Verified Application Policies:
    1.3.6.1.4.1.311.20.2.2 Smart Card Logon
    1.3.6.1.5.5.7.3.2 Client Authentication
Leaf certificate revocation check passed
Any idea, or I must open case with Microsoft support?
Best regards
Jacek Marek
MCSA Windows Server 2012

CWSerial/CWGPIB on Win7 :"The subject is not trusted for the specified action"

Hello,
I'm currently trying to migrate a VBA software from WinXP + Excel2000 to Win7 + Excel2010 and I'm encountering a big problem. The software is using activeX control such as CWSerial and CWGPIB but when I'm trying to add them I get the following error "The subject is not trusted for the specified action".
I'm more or less certain it's a permission problem, I just can't figure out how to solve it. I'm also pretty sure it's not a VBA version problem because I tried to do the same manipulation on a Win7 + Excel2000 machine and got the same error, so it must be related to the OS.
What I have already tried:
Regsvr32 on cwinstr.ocx.
Downgrading the Microsoft Office version to 2000 again.
Set Excel's Trust Center to enable all controls without restriction.
Fiddle with the registry keys following instructions on internet for similar problems.
Re-install everything on a new machine.
Did anybody face the same problem and/or has a solution? I'm working on a Virtual Machine so I can test every idea without fearing data loss.
Thank you for your help!

The only way to know what is going on is to retrieve the certificate and check who is the issuer.<br />
It is always possible that the server doesn't send the full certificate chain (intermediate certificates), so it might help to post a link to this website
Check the date and time in the clock on your computer: (double) click the clock icon on the Windows Taskbar.
Check out why the site is untrusted and click "Technical Details to expand this section.<br>If the certificate is not trusted because no issuer chain was provided (sec_error_unknown_issuer) then see if you can install this intermediate certificate from another source.
You can retrieve the certificate and check details like who issued certificates and expiration dates of certificates.
*Click the link at the bottom of the error page: "I Understand the Risks"
Let Firefox retrieve the certificate: "Add Exception" -> "Get Certificate".
*Click the "View..." button and inspect the certificate and check who is the issuer of the certificate.
You can see more Details like intermediate certificates that are used in the Details pane.
If "I Understand the Risks" is missing then this page may be opened in an (i)frame and in that case try the right-click context menu and use "This Frame: Open Frame in New Tab".
*Note that some firewalls monitor (secure) connections and that programs like Sendori or FiddlerRoot can intercept connections and send their own certificate instead of the website's certificate.
*Note that it is not recommended to add a permanent exception in cases like this, so only use it to inspect the certificate.

I am trying to download a free trial of photoshop for my macbook pro and it says there is an error and that the requirements for the new version is not supported for the mac I have. I have looked at the list of requirements but have no idea how to tell wh

I am trying to download a free trial of photoshop for my macbook pro and it says there is an error and that the requirements for the new version is not supported for the mac I have. I have looked at the list of requirements but have no idea how to tell what I do and do not have?

Apple Menu --> About this Mac.
Mylenium

The value 1 is not allowed for the field variace key

Hi experts,
When i was creating material master i was getting the status message as "the value 1 is not allowed for the field variance key" , but its stopping there its not moving out of that screen and creating the material record. When i see this field in the material master configuration its an optional field. Can you give me suggestions, where it can go wrong.
Thanks & Regards,
Ravi.

Hi
Can u tell me the field name . I cant get that field ref key. In which view does it come.
Reg
Raja

The specified index is not valid for the given resource

I am trying to follow the tutorial on how to get Labview working with Solidworks and the demo CNC robot that the example comes with. After I deploy all the axes and my computer and the assembly file I try and switch the scan engine to active mode but it won't let me. It pops up with an error;
"An error occured while attempting to switch the I/O scan mode. The specified index is not valid for the given resource".
I'm just trying to do a basic straight line move with one axis. Does anyone know how I can fix this? I updated softmotion with Sp1 already and did all the recommended updates.

I talked to some of our developers to get some more ideas for this error. Try the following:
Go to the file path C:\ProgramData\National Instruments\DeploymentFramework (it is a hidden file so you may need to change your settings to see it)
Delete the contents of that folder.
Restart LabVIEW
Redeploy your axes and see if it works.
If it does not, repeat the process but create a new project after LabVIEW restarts.
Cameron T
Applications Engineer
National Instruments

Business Rule err The following value is not valid for the run time prompt.

Hyperion Planning v 9.3.3
I have created a new BR with 2 local variables (created at the time of the BR), Variables are set as run time prompts. They are created as "Member" (not Members). The BR basically does a calc dim on dense and Agg on Sparce other than the prompt on Entity and Version dimensions. The entity variable has a limit on level 0 of the dimension. The Version variable limits to the input (Submit and Sandboxes)
The BR is associated in Planning with an input web form. Entity and Version are in the page. Is set to Run on Save and Use members on form.
If the run time prompts Hide boxes are checked, an empty Prompt pops up with only a Submit button. Click the button and an error comes up: "The following value is not valid for the run time prompt it was entered for:. But it does not indicate what member - just ends in the :.
The BR will run sucessfully only if the Run-time prompt is not hidden - "Hide" in the BR is unchecked. So the syntax and logic of the BR is correct and security should not be an issue.
The client wants no prompt. In production we have similar situations in which the BR works with the Web Forms without a prompt.
What am I doing wrong - I have tried restarting the Planning service and the EAS service.

My preferred method of doing this is:
1. In business rule, do not hide the run-time prompts. This makes it easy to validate the business rule as you are building it. I only use Global Variables.
2. On the form, have business rule set to run on save, use members on data form and hide prompt.
Check that in the business rule, for the variables (Run-Time prompts), that they are all in use. If not, delete them from the business rule. Are all your variables global? Are some local and some global? This could be the issue.
Deanna

Why is the IOS 8 update not available for the Iphone 4?

Why is the IOS 8 update not available for the Iphone 4? Will it ever be available? I cannont afford a new Iphone at this time so why am i being penalized for not having a new Iphone. Very upset

Scottwick wrote:
I think they want you to upgrade to the new Iphone or get the Iphone c or s
Well of course they would, but that's not why iPhone 4 can't have iOS8. It is simply the fact iPhone 4 can't support the features of iOS8. Le'ts be realistic in recognizing iPhone 4 is now over 4 years old. In cell phone land, that is ancient........

Write a query to get the users those are not appliyed for the exam?

hi frz i have two tables like User,UserHistory
User table contains clmns--Uid,Uname
UserHistory contain columns--Uid,Course,Status.
so i want to write a query to find out those are not applied for the particlur course i want to found only those records from the two tables...

Hello,
The SQL Server forums are over here:
http://social.msdn.microsoft.com/Forums/sqlserver/en-US/home
Karl
When you see answers and helpful posts, please click Vote As Helpful, Propose As Answer, and/or Mark As Answer.
My Blog: Unlock PowerShell
My Book: Windows PowerShell 2.0 Bible
My E-mail: -join ('6F6C646B61726C40686F746D61696C2E636F6D'-split'(?<=\G.{2})'|%{if($_){[char][int]"0x$_"}})

I can no longer get to my Google HOme Page using Firefox. because the issuer certificate is not trusted. (Error code: sec_error_untrusted_issuer).

I can access my Google Mail and Google Home Page just fine using IE.
I am currently using Firefox version 8.0.

Check the date and time in the clock on your computer: (double) click the clock icon on the Windows Taskbar.
*https://support.mozilla.org/kb/Secure+Connection+Failed
Clear the cache and the cookies from sites that cause problems.
"Clear the Cache":
*Tools > Options > Advanced > Network > Offline Storage (Cache): "Clear Now"
"Remove Cookies" from sites causing problems:
*Tools > Options > Privacy > Cookies: "Show Cookies"

Verifying the Workflow Configuration - does not appear for the workflow services.

hi!
the services for the workflow services is not in windows service, I´ve installed workflow manager and correctly configured, service bus correctly configured etc
verify

Which self Service function you are using to change the assignment ?
Their are two API to update asg values. Try to apply user hook on both of them and retry ur scenario.

The certificate is not trusted because no issuer chain was provided - firefox only

Hi,
I'm trying to get my website:
https://mgmt.pixafix.com/
and I'm getting the following error:
This Connection is Untrusted
mgmt.pixafix.com uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)
This is my website, and I've installed the certificate 2 month ago. I didn't check it using Firefox until now.
Firefox enter all other HTTPS website. All other browser entering my https domain with no warning.
Tested on 2 different machines:
Ubuntu - Firefox not working, Chrome - working fine (without any warning)
Mac - Firefox not working, Safari - working fine (without any warning)
I've tried the solutions described here:
https://support.mozilla.org/en-US/kb/connection-untrusted-error-message#w_the-certificate-is-not-trusted-because-the-issuer-certificate-is-unknown
And unable to use this solution because no firewall installed:
https://support.mozilla.org/en-US/kb/secure-connection-failed-error-message#w_the-certificate-is-not-trusted-because-no-issuer-chain-was-provided
Thanks in advance for any help,
Ziv

Thanks sahilnmmt but it not helping.
I'm downloaded the EssentialSSLCA certificate and import it into firefox using:
Advanced > View certificate > Authorities > import
Didn't check any checkbox there.
Restarted my Firefox, and still getting the same message.

Depot Sales - Goods issue not done for the delivery

Hello Experts,
I am trying to capture a Excise Invoice in the Depot Sales Process TCode - J1IJ.
I am getting the follwoing message - GI not done for the Delivery.
Process which we are following here is
Depot
SO - Delivery - Picking - Packing - J1IJ - Shipment creation - Shipment Planning - Loading Start - Shipment Start (Will do PGI) - Shipment end (Will create invoice & Excise Invoice).
Excise invoice is captured during MIGO at Depot.
Can you please suggest..
Thanks & regards
Mahesh

Hi mahesh
Change the process to following manner
Depot
SO - Delivery - Picking - Packing - Shipment creation - Shipment Planning - Loading Start - Shipment Start (Will do PGI) - Shipment end -J1IJ(Will create invoice & Excise Invoice).
u r problem will be solved.
Regards
kedasu.a

The SAPControl certificate is not trusted for the host

Similar Messages

Maybe you are looking for