Solution Manager 7.2 SP03 upgrade Experience

From the SUM log files, the latest error is sapcontrol can not perform the command:

Command line: f:\usr\sap\XXX\DVEBMGSXX\exe\sapcontrol -nr XX -host SAPPXX -user .\SAPServiceXXX <SecureField> -prot NI_HTTPS -function GetProcessList

The error is:

16.12.2016 12:54:57
GetProcessList
FAIL: SSSLERR_PEER_CERT_UNTRUSTED (WSATYPE_NOT_FOUND: The specified class was not found.), SapSSLSessionStart failed in plugin_fopen()

To fix the error - SSLERR_PEER_CERT_UNTRUSTED, a trust relationship needs to be established between the server and the client side.

To fix the error - SSLERR_PEER_CERT_UNTRUSTED, a trust relationship needs to be established between the server and the client side.

To achive this, you can use CA-signed certificates in your server side. As per default, your client trusts the servers from known CAs.

However if that is not possible, you can follow the below workaround temporarily to import the server certificate into the client's PSE. However importing a cerificate into a PSE, makes that such certificate is then trusted by the PSE and so it is a way to bypass the security trust. Please note that trusting arbitrary ceritificates can be a security risk and you should carefully inspect the certificate, e.g. you can use a browser with https:// <hostname>:5<XX14/?wsdl to see the actual certificate used by sapstartsrv (SAPSSLS.pse or (if not SAPSSLS.pse exists and kernel >= 7.42) sap_system_pki_instance.pse).

To import the server certificate into the client's PSE proceed as follows:
1. Run the below command with debug option:

/usr/sap/<SID>/<instance>/exe/sapcontrol -nr  <xx> -host  <hostname> -user  <sidadm> <Password for sidadm> -prot NI_HTTPS -debug -function GetProcessList
2. You should notice the PSE which is being used:

3. Take a note of the PSE (e.g. in the above case, it is $SECUDIR/SAPSSLC.pse)

4. You should notice the server certificate in the debug trace and the error towards the end.

5. Copy the content of the base64 encoded server certificate from the debug trace to a file <cert file>

6. Add the server certificate (downloaded in the  <cert_file>) to the to the certificate list of client's pse identified in Step 3.

This can be done with the command: sapgenpse maintain_pk -p <abosulte path to client PSE as identified in Step 3>/<PSE Name> -a <cert file>
7. Test the configuration by running the command:

/usr/sap/<SID>/<instance>/exe/sapcontrol -nr  <xx> -host  <hostname> -user  <sidadm> <Password for si1adm> -prot NI_HTTPS -function GetProcessList

A valid output should be received.

8. Repeat the phase in SUM.

It is important to note that modifying the PSE from sapgenpse tool is temporary and the changes will be lost after an instance restart. As an alternative you can also import the server certificate into the client client's PSE through STRUST, by exporting the server certificate in Base64 format and then import it into the client's PSE and add to the certificate list. This will ensure that the changes in PSE are synchronized and not lost after instance restart.

After the upgrade with SUM is complete, you can remove the added certificate if HTTPS communication between sapstartsrv and sapcontrol is not required.