Error: "iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier"

	English	
Deutsch - Machine Translation Español - Machine Translation Français (France) - Machine Translation Italiano - Machine Translation 日本語 - Machine Translation 한국어 - Machine Translation Português (Brasil) - Machine Translation Русский - Machine Translation 简体中文 - Machine Translation

Support Note KB0396360

Issue

SAP PI SAP Business Network adapter for SAP Netweaver(SAP Business Network adapter) used in Cloud Integration scenarios fails with below error in SAP Business Network adapter debug logs:

Error: SOAP: Error occurred: com.sap.engine.interfaces.messaging.api.exception.MessagingException: java.io.IOException: Failed to get the input stream from socket: iaik.security.ssl.SSLCertificateException: Peer certificate rejected by ChainVerifier

Resolution

Verify the SAP Business Network URL and keystore information in your SAP PI Communication Channel using below steps:

Navigate to SAP PI Integration Builder.
Locate the Communication Channel that uses SAP Business Network adapter which has the issue.
Check for the GetProfile URL used in the channel to connect to SAP Business Network. (E.g. service.ariba.com etc)
Check for the Trust Store View used in the channel which is the PI Java keystore name. (E.g. TrustedCAs)

Next, upload the latest AN server certificates for this AN URL using below steps:

Navigate to SAP NetWeaver Administrator > Configuration > Certificates and Keys > Key Storage.
Key in the Name of the keystore. (refer to the name from step 4 above)
Remove the old certificates of the URL from View Entries.
You can obtain the latest certificates for different URLs from SAP Ariba Public DigiCert Web Server Certificates. Download the ones relevant to the URL being used by you and upload them in your PI Java keystore. ( refer to step 3)
Ensure to upload Root + Intermediate + Leaf(SSL) certificates for this URL in your SAP PI keystore. For more guidance on this step, refer to FAQ How do I download the root, intermediate and leaf certificates from any given certificate?

Lastly, Stop and Start the Communication Channel from SAP PI Communication Channel Monitor.

Cause

Complete certificate chain of the latest SAP Business Network certificates of the GetProfile URL used in SAP Business Network adapter to connect to AN that were uploaded in your SAP PI Java keystore might have either expired or corrupted.

Applies To

SAP Business Network for Procurement & Supply Chain