2461900 - SSSLERR_PEER_CERT_UNTRUSTED error in dev_icm or dev_webdisp trace

With the local system acting as the client, the TLS handshake fails with the destination server. The following error (or similar) is recorded in the ICM trace (dev_icm) or the SAP Web Dispatcher trace (dev_webdisp):

[Thr <thr_no>] The peer's X.509 Certificate (chain) is untrusted
[Thr <thr_no>] SapSSLSessionStartNB()==SSSLERR_PEER_CERT_UNTRUSTED
[Thr <thr_no>] SSL:SSL_read() failed (536872221/0x2000051d)
[Thr <thr_no>] => "Failed to verify peer certificate. Peer not trusted."
[Thr <thr_no>] SSL:SSL_get_state()==0x2131 "TLS read server certificate B"
[Thr <thr_no>] SSL NI-hdl 89: local=<host:port> peer=<host:port>
[Thr <thr_no>] cli SSL session PSE "X:\usr\sap\<sid>\<inst>\sec\<SAP_PSE>.pse"
[Thr <thr_no>] Target Hostname="<hostname>"

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

Where <SAP_PSE> can be any PSE. For example:

• Anonymous: SAPSSLA
• Standard: SAPSSLC
• Server: SAPSSLS
• Individual: SAPSSL<name>

PSE regeneration via STRUST (auto or manual) silently wipes all previously imported trust entries

HTTP error code 503 occur before any HTTP processing, making it distinguishable from backend application errors

• SAP NetWeaver ABAP Application Server
• SAP Web Dispatcher
• ABAP Platform based product

The peer's X.509 Certificate (chain) is untrusted, Failed to verify peer certificate, Peer not trusted, RFC, LMDB_SYNCDEST, STRUST, PSE, Trusted certificate, Chain, ICM, Peers, Peer certificate (chain) is not trusted, issue in SSL, dev_icm, SSSLERR_PEER_CERT_UNTRUSTED, ICM_HTTP_SSL_PEER_CERT_UNTRUSTED, Fiori, My Inbox, Gateway, upgrade, Portal, LDAPS. 636, Native SSL Error, 500 SSL Peer Certificate Untrusted, SSL handshake with , KBA , BC-CST-IC , Internet Communication Manager , BC-CST-WDP , Web Dispatcher , BC-SEC-SSL , Secure Sockets Layer Protocol , Problem