Peer certificate rejected by ChainVerifier

Help
1

Hello,

One of my api endpoints is SSL enabled using LetsEncrypt cert.

The end point is used by SAP for posting and pulling data.

The flow works great as long as the cert is manually uploaded to SAP.

However when the Cert expires, it starts throwing an exception (expected) :

Screenshot 2024-12-24 at 9.55.06 AM
Screenshot 2024-12-24 at 9.55.06 AM2189×166 68.2 KB

Once new certificate is uploaded to SAP, it starts working again.

Question:

Is there any way to setup SAP that anyone is aware of to accept any certificate issued by LetsEncrypt similar to how the browser handles it? Some way to setup SAP to setup LetsEncrypt as a valid CA so that it accepts new certs without having to manually upload every 60 days?

Thanks much for the help.

2

When you opened this thread in the Help section, you should have been provided with a questionnaire. Maybe you didn't get it somehow (which is weird), or you've decided to delete it. In any case, all the answers to this questionnaire are required:

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

We need the hostname of the API endpoint so we could see if the chain that's send by the webserver is correct. Or you could use e.g. SSL Certificate Checker and/or SSL Checker yourself (random sites from Google, no experience with them myself) to see if the API is sending the correct chain.

2 Likes
3

Can you upload the Let’s Encrypt CA to SAP instead if a cert? What’s the UI look like? Or do you have any SAP docs?

I think really this is going to be something you should ask SAP, though

5 Likes
4

I have suggested and shared the same to the SAP impl team. Awaiting feedback.

5

Yes. I have checked the cert. The chain is correctly sent by the server.

6

Probably not.

I don't know what product you are using, but Enterprise products like the SAP one you are using are typically designed to be used with self-signed certificates or private CAs for granular authorization, and not publicly trusted roots. Check your product docs to see if they are referencing self-signed certs, if so you can probably just generate a yearly cert (or similar) that is self signed.

If this SAP product is deigned like that and you need to provide the API on a public root, a common trick is to just have the API run on two different domains - one public and one private.

Edit: LetsEncrypt certs provide Domain Validation for public trust, many enterprise (commericial and open source) products leverage Certificates for granular identity/access/authorization - the systems are designed to ensure a specific cert or signing authority has authorized access.

5 Likes