For the love of me I can't figure out what the problem is. The tutorial I developed from the last time we did a PRD to DEV SAP copy doesn't seem to work this time around to solve the problem.
What I keep running into is the error is that it finds the "Root" certificate but it doesn't match the given PKRoot.
[Thr 3596] Tue Mar 02 09:17:10 2010
[Thr 3596] *** ERROR during SecudeSSL_SessionStart() from SSL_connect()==SSL_ERROR_SSL
[Thr 3596] SecudeSSL_SessionStart: SSL_connect() failed --
secude_error 9 (0x00000009) = "the verification of the server's certificate chain failed"
[Thr 3596] >> -
Begin of Secude-SSL Errorstack -
>>
[Thr 3596] ERROR in ssl3_get_server_certificate: (9/0x0009) the verification of the server's certificate chain failed
ERROR in af_verify_Certificates: (27/0x001b) Chain of certificates is incomplete : "CN=*.server.local, OU=<our CO>, OU=SAP Web AS, O=SAP Trust Community, C=DE"
ERROR in get_path: (27/0x001b) Found root certificate of <CN=*.server.local, OU=<our CO>, OU=SAP Web AS, O=SAP Trust Community, C=DE> which does not fit the given PKRoot
ERROR in verify_with_PKs: (27/0x001b) Found root certificate of <CN=*.server.local, OU=<our CO>, OU=SAP Web AS, O=SAP Trust Community, C=DE> which does not fit the given PKRoot
[Thr 3596] << -
End of Secude-SSL Errorstack -
[Thr 3596] SSL_get_state() returned 0x00002131 "SSLv3 read server certificate B"
[Thr 3596] SSL NI-sock: local=192.168.251.119:2821 peer=192.0.2.31:44300
[Thr 3596] <<- ERROR: SapSSLSessionStart(sssl_hdl=04BBA228)==SSSLERR_SSL_CONNECT
[Thr 3596] *** ERROR => IcmConnInitClientSSL: SapSSLSessionStart failed (-57): SSSLERR_SSL_CONNECT [icxxconn.c 2012]
[Thr 3596] *** ERROR => IcmConnClientRqCreate() failed (rc=-14) [icrxx.c 5234]
[Thr 3596] *** ERROR => Could not connect to SAP Message Server at onebase. URL=/msgserver/text/logon?version=1.2 [icrxx.c 2591]
[Thr 3596] *** ERROR => rc=-1, HTTP response code: 0 [icrxx.c 2592]
[Thr 3596] *** ERROR => see also OSS note 552286 [icrxx.c 2593]
I question is where is it comparing to the PKRoot at? I have no clue where it's looking for that at.