How To Fix 5C380 - Signature of response message could not be verified

SAP Error Message - Details

• Message type: E = Error

• Message class: 5C - HR: Messages for Switzerland

• Message number: 380

• Message text: Signature of response message could not be verified

What causes this issue?

The system received a response that was not classified as an error
message. According to the guidelines for wage data transfer, responses
that are not error messages must be signed by the sender (in this case,
by the distributor to which you sent the message). The recipient must
check the signature of the response and must not further process
responses with an invalid signature in the usual way.
This is most likely to affect the verification of the correctness of the
response signature.
This can be for the following reasons:
The distributor has not signed the response, or has signed it with an
invalid signature. You can determine whether the signature is missing
entirely by displaying the corresponding XML file in the process data
overview.
The content of the response was forged or changed, either intentionally
or unintentionally, on the way from the distributor to you.
The distributor also coded the response.
The signature check does not work or is set up incorrectly (for example,
is checked against the incorrect certificate, or an error message was
incorrectly not identified as such).
The PI disappeared between receipt of the response and the signature
check, or can no longer be reached.

System Response

The received response is saved with the process data of the current step
for further analysis. The data from the response must not be further
processed in the usual way.

How to fix this error?

You can view or download the received response as an XML file in the
process data overview for further analysis. You can use the
interoperability check to check whether all systems can be reached.
Depending on the cause, contact your system administrator, the
distributor, or support.
You can repeat queries on the processing status of sent wage
notifications (meaning a response with a valid signature and OrderID has
already been received) by manually resetting the process to the "Query
Status Again" step and starting again.
If you need to resend the wage notification and a 'JobKey' element is
contained in the notification with the invalid signature in the XML
display, check with the distributor whether the job should be stopped
before it is resent or if you should indicate the new notification as a
replacement notification.
To indicate the notification as a replacement notification, when
recreating the notification enter the content of the "OrderID (ELM)"
field from the notification context (select step 0 and the "Display"
pushbutton) and the content of the 'ResponseID' field from the
distributor?s response (use XML file display and search function) in the
data extractor?s selection screen (report 'RPLELMC0').
Sending and receiving coded messages is currently only an optional wage
standard option and is not supported. In this case, ask the distributor
to send the responses uncoded. (Note: In the configuration, the PI
provides the options of activating the coding/decoding in the same way
as the signature. This option probably works, but has not been certified
and tested.)

Procedure for System Administrators

The signature check is performed by the PI. The cause can be further
analyzed via the security logs and the message monitor. In particular,
this means that it can be checked whether the signature check or the
signature is incorrect.
For the signature check to work, the correct distributor?s certificate
must be imported into the key store and be configured for the
corresponding integration scenario.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message 5C380 - Signature of response message could not be verified ?

  The SAP error message 5C380 ("Signature of response message could not be verified") typically occurs in the context of SAP's integration with external systems, particularly when dealing with web services or communication protocols that require message signing for security purposes. This error indicates that the digital signature of a response message could not be validated, which can lead to issues in data integrity and security.
  Causes:
  
  Invalid Signature: The response message may have an invalid or corrupted signature, which can happen due to transmission errors or tampering.
  Mismatched Keys: The public key used to verify the signature may not match the private key that was used to sign the message. This can occur if the keys are not properly configured or if the wrong key is being used.
  Configuration Issues: Incorrect configuration in the SAP system or the external system regarding security settings, such as the signing algorithm or certificate settings.
  Expired Certificates: If the certificate used for signing has expired, the signature verification will fail.
  Encoding Issues: Problems with the encoding of the message can also lead to signature verification failures.
  
  Solutions:
  
  Check the Signature: Verify that the signature in the response message is correct and has not been altered. You may need to compare it with the expected signature.
  Validate Keys: Ensure that the public key used for verification matches the private key used for signing. Check the key configurations in both the SAP system and the external system.
  Review Configuration: Check the configuration settings in SAP and the external system to ensure that they are set up correctly for message signing and verification.
  Update Certificates: If the certificate has expired, obtain a new certificate and update the configuration in both systems.
  Check Encoding: Ensure that the message is properly encoded and that there are no issues with the format that could affect signature verification.
  Consult Logs: Review the application logs in SAP for more detailed error messages that can provide additional context about the failure.
  
  Related Information:
  
  SAP Notes: Check SAP Notes for any known issues or patches related to this error message. SAP frequently updates its knowledge base with solutions for common problems.
  Documentation: Review the documentation for the specific SAP module or integration technology you are using (e.g., SAP PI/PO, SAP Cloud Platform Integration) for guidance on configuring message signing and verification.
  Security Settings: Familiarize yourself with the security settings in both SAP and the external system, including how to manage keys and certificates.
  
  If the issue persists after trying the above solutions, it may be beneficial to engage with SAP support or consult with a technical expert who specializes in SAP integrations.