3646911 - Extracting the SSL Server Certificate from the SAP Host Agent

The SSL error message "Failed to verify peer certificate. Peer not trusted." is observed on the ICM trace file (dev_icm) when the SAP ALM is activated.

The ICM trace file shows that the instance is trying to connect to the SAP Host Agent HTTPS port (port number 1129) on the local server:

[Thr ...]              ASYNC_RFC Tzzz_Uyyy_M0, [client], [ALM user], [local server name], time=19:42:22, Wxx, program=SAPMSSY1, low priority, memory=0, tasks=2, appl info=, tcode=
[Thr ...]              role: Client, protocol: HTTPS, local: [local server IP address]:[random client port], peer: [local server IP address]:1129
[Thr ...]   SSL_get_state()==0x2131 "TLS read server certificate B"
[Thr ...] *** ERROR in secussl_read: SSL_read() lasterr 0x2000051d
[Thr ...]   => "Failed to verify peer certificate. Peer not trusted."

It is required to extract the SSL Server Certificate from the SAP Host Agent, so the appropriate SSL trust can be established.

• SAP Host Agent

KBA , BC-CCM-HAG , Host Agent , BC-CST , Client/Server Technology , Problem