SAP FIM Connection to SAP FC FCWebServices is invalid

Issue:

Connection ‘<hidden>’ is invalid. java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext) Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)

The error happens when you make a connection test between SAP FIM and SAP FC and SAP BO IPS 4.2 SP 8 has been upgraded to IPS 4.3 SP 2 with new version of Tomcat and SAPJVM.

SAP FIM test connect to SAP

Environment:

SAP Financial Consolidation 10.1
SAP BO IPS 4.3 SP2 Patch 11, SAP Financial Information Management 10.0 SP18 and SAP Data Service 4.3 SP02 PL 2
Apache Tomcat 9 is a webserver
SAP Financial Consolidation server is installed on a separate server
You are using httpS in SAP FC WebService.

You scenario is: SAP FIM -> SAP DS -> SAP FC

How to investigate:

You need to check <INSTALL_DIR>\IPS42\tomcat\logs\stderr.log and look the error:

SEVERE [http-nio-8080-exec-1] com.sap.fpm.fim.server.util.WSExceptionMapper.toResponse WSException sending :
	com.sap.fpm.fim.common.webservice.WSException: Connection '<hidden>' is invalid.

	Caused by: java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
		
		... 88 more
	Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
		
		... 90 more
	Caused by: java.security.KeyStoreException: problem accessing trust store
		at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:73)
		
		... 103 more
	Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
		
		... 112 more
	Caused by: java.security.UnrecoverableKeyException: Password verification failed
		
		... 120 more

The error says the password verification failed and we need to check our keystore password:

1. Go to <INSTALL_DIR>\IPS42\tomcat\conf\server.xml
2. Find SSL configuration section

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="200" SSLEnabled="true" scheme="https" secure="true">
    <SSLHostConfig protocols="TLSv1.2" >
        <Certificate certificateKeystoreFile="<Directory>\keystore.jks" certificateKeystorePassword="<your_keystore_password>"/>
    </SSLHostConfig>
</Connector>

3. Open Tomcat Configuration app via Start menu

Tomcat Configuration

3. Find Java parameters (SSL configuration)

-Djavax.net.ssl.trustStore=<Directory>\keystore.jks
-Djavax.net.ssl.trustStorePassword=<your_keystore_password>
-Djdk.tls.client.protocols=TLSv1.2

4. Check the password is correct via Keytool utility as per (SAP Docs)

keytool -list -keystore <filePath>\keystore.jks -storepass <storepass>

If the keystore password works and you have SSL configuration in server.xml and Tomcat configuration, it is the cause of this error and why SAP FIM connection test doesn’t work properly.

Solution:

You need to remove Java parameters in Tomcat Configuration application.

Java parameters: -Djavax.net.ssl.trustStore , -Djavax.net.ssl.trustStorePassword , -Djdk.tls.client.protocols

Successful SAP FIM test

Useful notes and links:

1648573 - How to configure SSL/TLS on Tomcat in BI 4.x

2642154 - Error: "There is no response for the web service <DISCOVER_RFCSRV>" when SSL is enabled for Tomcat- SAP Data Services
1960570 - How to configure FIM and Data Services to use SSL? - FIM - SAP ONE Support Launchpad
2231938 - Error RUN-248005 during data load to BPC using FIM

https://wiki.scn.sap.com/wiki/display/CPM/Troubleshooting+the+integration+between+Financial+Information+Management+and+Financial+Consolidation
https://wiki.scn.sap.com/wiki/display/CPM/Financial+Consolidation+-+troubleshooting+the+Webservices
https://wiki.scn.sap.com/wiki/display/EIM/Web+Services+Troubleshooting