"RFC_COMMUNICATION_FAILURE- SSSLERR_PEER_CERT_UNTRUSTED" error occurs while connecting to IBP datastore via webRFC connection - SAP Cloud Integration for Data Services

Error:  "RFC_COMMUNICATION_FAILURE- SSSLERR_PEER_CERT_UNTRUSTED" error occurs while connecting to IBP datastore via webRFC connection - SAP Cloud Integration for Data Services.

Cause

The IBP server certificate added to the PSE file is incorrect.

Resolution

Pull up Google Chrome web browser.

Open up the IBP tenant URL (https://myXXXXXX.scmibpX.ondemand.com).

Login to IBP with a user name and password.

Click on the padlock in front of the URL, and then on the arrow on the "Connection is secure" line.

On the next screen, click on the box at the end of "Certificate is valid".

On the next screen, click on the "Details" tab and select the root "DigiCert Global Root G2" certificate.

 press "Export...":

In the export wizard choose Base-64.

Give it a name and save it.

Transfer that file to the agent server's file system.

Add the IBP server certificate to the PSE file by command:

<agent_installation_folder>\bin\sapgenpse maintain_pk -a <path>/<certificate>.cer -p <file.pse> -x <PIN>

Example:

sapgenpse maintain_pk -a C:\ProgramData\SAP\DataServicesAgent\ssl\sec\ZZZ.cer -p ibp_webrfc.pse -x Passw0rd! 

Note: the IBP server certificate can be exported in any web browser. In this example we used Google Chrome for demonstration.

How to import [Digicert] certificates in CPI-DS ?

How to import [Digicert] certificates in CPI-DS ? 

 We need to apply Cert in different situations like when it expires or because of the below errors too. 

Errors: 

• Certificate error: connect to <CPI Cloud> failed: Connection timed out
• Agent is not able to connect to the CPI Data Services server

The CPI-DS server will start to use SSL certificate from Digicert instead of Symantec.

1. Run configureAgent

On Windows platforms, run configureAgent.bat

On Linux platforms, run configureAgent.sh

     Note: You must run the configuration program from a user account that has administrative privileges. On Windows platforms that have User Account Control (UAC) enabled, you can also choose "Run as administrator" option.

2. Download and unzip the atttached zip file. There are four certificates in the package.

3. On the new opened window, click "Import Certificates" from the left pane. 

4. In Select a certificate file, browse to the first certificate and select Import.

5. Repeat step 4 for each certificate

How to import [Digicert] certificates in CPI-DS

SAP IBP Default Client Certificate Renewal procedure.

 If you use the default client certificate for certificate-based authentication in outbound integration scenarios, you must update the trust between the systems when a new default client certificate is issued.

Context

In outbound integration scenarios that use certificate-based authentication, SAP IBP needs to authenticate itself against the external system with a client certificate. For this purpose, you can use the default client certificate provided with SAP IBP. This certificate is valid for one year. Before its expiration, SAP issues a new certificate. The public key of this new certificate needs to be uploaded into the trust store of your external system that communicates with SAP IBP.

89 Days Before Expiration

The certificate renewal process begins 89 days before the expiration of the default client certificate. At that time, you will receive an email informing you about the upcoming expiration and the planned issuing of the new default client certificate.

You will not be required to take any action yet; however, we recommend that you prepare for the certificate replacement by checking which of your communication systems use the default client certificate for authentication and planning your replacement activities.

To check which communication systems use the default client certificate, open the Maintain Client Certificates app, select the Client Default certificate and choose the Communication Systems tab on the right.

30 Days Before Expiration

30 days before the expiration, SAP issues a new default client certificate. You will be informed about it by email.

The new default client certificate will be available for download in the Maintain Client Certificates app. It will be called Client Default. The expiring certificate will be renamed to Client Default Expiring.

Once the new default client certificate is available, you need to do the following:

1. Open the Communication Systems app. Select the system that uses the default client certificate for outbound communication.
2. In the Users for Outbound Communication section, change the certificate that is used by the user for outbound communication from Client Default Expiring to Client Default.
3. Choose Download Certificate to download the public key of the default client certificate.
4. Upload the public key that you have downloaded into the trust store of your external system.

Note

The communication scenario will not work during the process of replacing certificates. In order not to disrupt the integration process, perform this action when the scenario is not in use.

Please switch to the new certificate as soon as possible, so that if any problem arises, it will be feasible to troubleshoot the issue within the 30-day overlap of the certificate validity periods.

On the Expiration Date

Once the old certificate expires, it will be removed from the list in the Maintain Client Certificates app. You will receive a confirmation of this action by email.

What Happens If You Don't Act

If you don’t update your communication users and your external system trust store with the new certificate, the outbound integration scenarios which use the default client certificate for authentication will be broken. You will get the 403 Forbidden HTTP status code message when trying to connect.

Contact Information

In case of questions and problems, please open a customer message using the component SCM-IBP-OPS-INC, with a title like "Default Client Certificate Renewal in SAP IBP".

2801396 - SAP Global Trust List - SAP for Me

What are the different profiles in the Client Copy ?

 What are the different profiles in the Client Copy ? 

Local Client Copy

The local client copy takes place within a system. The local client copy is started via transaction SCCLN.

Remote Client Copy

The remote client copy copies data from an external system to another client in the target system using RFC. The process is always started from the target system. The remote client copy is started via transaction SCC9N.

SCC

How to activate SAP Gateway or Error " SAP Gateway has been deactivated" ?

 How to activate SAP Gateway or Error " SAP Gateway has been deactivated" ? 

SAP NetWeaver Gateway, OData Service, HTTP request, /N/IWFND/ERROR_LOG

Issues: 

1: How to activate SAP Gateway in S4HANA/ SAP application 

2: After the system refresh or client we may receive complaints from users about Fiori tiles not loading.

3: We may see the error in "/n/UI2/GW_ERR_LOG" Gateway-Error Log. 

We can reproduce issue by Call a HTTP request or use transaction /N/IWFND/ERROR_LOG to view the error log.

Resolution: 

Activate SAP Gateway by going to the following path in your Gateway system:

SPRO -> SAP Customizing Implementation Guide -> SAP NetWeaver -> Gateway -> OData Channel -> Configuration -> Activate or Deactivate SAP NetWeaver Gateway.

OR

Use transaction: /n/IWFND/IWF_ACTIVATE

Click "Activate".

Thanks

Rupesh Chavan

Data Compression in the Column Store in SAP HANA Database and its types

Data Compression in the Column Store

The column store allows for the efficient compression of data. because that its make HANA database less costly for keeping data in main memory. It also speeds up searches and calculations.

Types of data compression in the HANA database 

Data in column tables can have a two-fold compression:

• Dictionary compression

  This default method of compression is applied to all columns. It involves the mapping of distinct column values to consecutive numbers so that instead of the actual value being stored, the typically much smaller consecutive number is stored.

• Advanced compression

  Each column can be further compressed using different compression methods, namely prefix encoding, run length encoding (RLE), cluster encoding, sparse encoding, and indirect encoding. The SAP HANA database uses compression algorithms to determine which type of compression is most appropriate for a column. Columns with the PAGE LOADABLE attribute are compressed with the NBit algorithm only.

Compression is automatically calculated and optimized as part of the delta merge operation. If you create an empty column table, no compression is applied initially as the database cannot know which method is most appropriate. As you start to insert data into the table and the delta merge operation starts being executed at regular intervals, data compression is automatically (re)evaluated and optimized.

Automatic compression optimization is ensured by the parameter active in the optimize_compression section of the indexserver.ini configuration file. This parameter must have the value yes.

Thank

Rupesh Chavan

How S-users can manage their own Cloud System Notification Subscriptions in the CSNS - SAP ONE Support Launchpad / SAP for Me ?

How S-users can manage their own Cloud System Notification Subscriptions in the CSNS - SAP ONE Support Launchpad / SAP for Me

1. You can access the application one of two ways:

SAP ONE Support Launchpad > Cloud System Notification Subscriptions via SAP ONE Support Launchpad (or from Cloud Availability Center click Manage Notifications (clipboard icon) top right)

SAP for Me > Manage Cloud Availability Center Notifications

2. The Manage Cloud Availability Center Notifications page will open

3. Click + Add Subscription

4. Fill out the Add Subscription fields

Only Cloud Products licensed to your customer number will be available to subscribe to.

The Tenant choice is optional. If you choose the tenant level, you will only receive notifications for that particular tenant.

5. Click Add

6. If desired, you can modify the Notification Type(s)

Choose which types of notifications you would like to receive for cases of both planned and unplanned downtimes, as well as customer communication notifications.

7. Click Save .

8. After clicking Save, from that same screen you can click Add Subscription on the top of that section to continue to create additional subscriptions.

How to modify a subscription type

1. In the My Subscriptions list, find the entry you wish to modify, and click the Edit (pencil icon) 

2. Make changes to the Notification Type section

3. Click Save.

How to turn OFF (delete/unsubscribe from) a cloud notification

1. In the My Subscriptions list, find the entry you wish to remove and click Delete (trash can icon) (or click Delete in the side panel after viewing the subscription entry)

2. Click Delete on the Confirm screen

Thanks 

Rupesh Chavan

How to change the host name of the URL when calling SAP Fiori launchpad from the transaction code /n/ui2/flp ?

 "The Connection for This Site is Not Secure" error when accessing SAP Fiori launchpad from the transaction code /n/ui2/flp ? 

or

How to change the hostname of the URL when calling SAP Fiori launchpad from the transaction code /n/ui2/flp

Error : 

1. Access the SAP GUI
2. Run the transaction code SM30
3. Maintain the table HTTPURLLOC
4. Input /sap/bc/ui2/flp  in the "Application" field
5. Input the target hostname in the field "Host Name", the format is test.sap.com, there is no "https://" or port
6. Input the port number in the "Port" field. However, if you are not using any port number in the URL when calling the target host, it doesn't mean there is no port, it is just using the default port which is 443. in this case, please input 443
7. Please note, changes are not cross all clients. The same has to be done for each client separately 

Thanks 

Rupesh Chavan

How to identify the transport requests that includes the changes to an specific catalog in the CUST layer

 You performed some changes in a catalog and you want to know all the transports requests that includes changes in this catalog.

Resolution

First of all, we need to know the catalog name. We can Find it in Launchpad designer in this example the name is X-SAP-UI2-CATALOGPAGE:SAP_FND_BC_MANAGER_T

2: Go to SE16 in gateway system and open table WDY_CONF_USERT.

3: Paste in description field the catalog name we found above between* symbols. *X-SAP-UI2-CATALOGPAGE:SAP_FND_BC_MANAGER_T* then display the result.

4: You will get 2 entries. Take the second one and copy the config_Id number. example 004CA9EF18A7B9D5FD60DD27C10FEC5E

5: Now go again to SE16 and open the table E071K

6: in the tabkey field use the multiple selection icon and specify the value *config_id* (example *004CA9EF18A7B9D5FD60DD27C10FEC5E*)

7: Then display the table entries and you will see the assigned transport request under the TRKORR column

Note: SAP note 2693061

Thanks 

Rupesh Chavan