3240107 - Generic Error when uploading SSL Certificate in CSB - Recruiting Marketing

When uploading the SSL Certificate files in CSB the following error is returned : "An error occurred. Please try again later."

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental. 

SAP SuccessFactors Recruiting Marketing

1. Go to Manage Career Site Builder from Admin Center. 
2. Go to Tools > SSL Certificate
   1. If CSR has been generated using Option 1, click on upload and upload the SSL and Intermediate Certificate.
   2. If Uploading the certificate using Option 2, "I want to upload an SSL certificate that I obtained using my own CSR." Upload the SSL, Intermediate Certificate and Private Key.    
3. Upon upload the error message is shown and the files are not uploaded.

There are different possible causes for this error:

1. CSR generated in CSB does not match the SSL Certificate. (Trying to upload an SSL Certificate obtained using a different or third party CSR through Option 1 which is reserved for SSLs obtained from CSB generated CSRs)
2. CSR and SSL don't match (error during SSL provisioning process)
3. Invalid Intermediate Certificate Format. 
4. The .PEM file uploaded is a bundle and does not only contain the SSL Certificate.
5. The third party CSR used to procure the SSL didn't have all the required information.

1) CSR and SSL mismatch : 
1- If a CSR was generated in CSB and the user attempts to use Option 1 to upload the SSL when the error is shown it likely means the CSR generated in CSB does not match the SSL Certificate and a different CSR was actually used to procure the SSL. In this case, Option 2 should be used instead to upload the SSL files. 
To check if the CSR and SSL match : 

1. Open the CSR and SSL Certificate using a Notepad, Notepad++ or any similar application. If the SSL Certificate contains more than one certificate, this means that the SSL Certificate contains the intermediate certificate as well. Hence, it needs to be saved separately. 
2. Copy the text of the CSR and SSL certificate on Certificate Key Matcher. If the CSR and SSL Certificate Don't match, this means that the SSL certificate was generated without using the CSR that was generated in CSB. In order to use the SSL Certificate, the "Private Key" is needed from the vendor. 
3. The SSL Certificate can then be installed using option 2: I want to upload an SSL certificate that I obtained using my own CSR. 

2) CSR and SSL mismatch : If the SSL certificate was generated using CSR from elsewhere and is being uploaded using option 2 and getting the error, the same steps can be performed to check for mismatches.

However, on both scenarios, if the SSL Certificate matches the CSR and still getting the error, create a ticket to support and provide a copy of the SSL Certificate and the Intermediate Certificate on the attachment. 

Note: DO NOT attach the private key.

3) Invalid Intermediate Certificate Format: 

Contact your Certificate Authority (CA) to request the intermediate certificate file in PEM, CRT or CER format.

Alternatively, refer to the KBA 3299713 to extract the Intermediate Certificate (.cer) from the SSL certificate.

Some Certificate Authorities (CA) provide two intermediate certificates. Refer to the KBA 3111993 to combine them in one single file.

4) The .PEM file uploaded is a bundle and does not only contain the SSL Certificate.

Contact your Certificate Authority (CA) to request a valid SSL Certificate file.

5) The CSR doesn't have all the required information

1. If you're using the Option 2, access the CSR Decoder
2. Enter the CSR
3. You will see at least 1 of the following required information missing:
   • Common Name
   • Organization
   • Organizational Unit
   • City/Locality
   • State/County/Region
   • Email address
       
4. Please generate a new CSR providing all the above information, then ask the Certificate Authority to procure the Certificates again.
   
   Alternatively, customers can choose to use a standard URL for their career site, with a generic SAP domain, so that they don't have to maintain the DNS and SSL certificates. See Standard Site URLs for Career Sites.

Overview:

• 2231401 - Updated SSL Certificate Renewal process - Recruiting Marketing
• 3109381 - Overview About SSL Certificates tab in CSB - Recruiting Marketing
• 3153100 - How to Identify SSL Certificate, Intermediate Certificate/s and Private Key - Recruiting Marketing

Intermediate Certificate:

• 3156722 - How to generate an intermediate certificate - Recruiting Marketing
• 3299713 - How to extract the Intermediate Certificate (.cer) from the SSL certificate - Recruiting Marketing
• 3111993 - How to Upload Two Intermediate Certificates in CSB - Recruiting Marketing

Private Key:

• 3132774 - Private Key file not accepted in Career Site Builder SSL tool - Recruiting Marketing

Upload, Private key, SSL Certificate, Install, Renew, error, csr , KBA , LOD-SF-RMK-CER , Certificate Renewal, IP Address, Domain , LOD-SF-RMK-CSB , Career Site Builder , Problem