How To Fix ICF_SYSTEM_LOGIN333 - Current system setting deactivates certificate request

SAP Error Message - Details

• Message type: E = Error

• Message class: ICF_SYSTEM_LOGIN - Messages for System Logon

• Message number: 333

• Message text: Current system setting deactivates certificate request

What causes this issue?

The current system setting of parameter icm/HTTPS/verify_client
deactivates the certificate request. If this parameter defines that the
server does not request a certificate from the browser, no certificates
are forwarded in the system logon to the services for certificate issue
or assignment.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

Check the current setting of parameter icm/HTTPS/verify_client.
(Transaction RZ11)

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message ICF_SYSTEM_LOGIN333 - Current system setting deactivates certificate request ?

  The SAP error message "ICF_SYSTEM_LOGIN333 Current system setting deactivates certificate request" typically occurs when there is an issue with the configuration of the Internet Communication Framework (ICF) in your SAP system, specifically related to the handling of SSL/TLS certificates for secure communication.
  Cause:
  This error indicates that the current settings in the SAP system do not allow for the generation or handling of certificate requests. This can happen due to several reasons, including:
  
  ICF Service Configuration: The ICF service responsible for handling SSL/TLS connections may not be properly configured or activated.
  System Parameters: Certain system parameters related to SSL/TLS and certificate handling may be set to values that disable certificate requests.
  Authorization Issues: The user or service trying to initiate the certificate request may not have the necessary authorizations.
  Missing or Incorrect SSL Configuration: The SSL configuration might be incomplete or incorrect, leading to the inability to process certificate requests.
  
  Solution:
  To resolve this issue, you can follow these steps:
  
  
  Check ICF Service Activation:
  
  Go to transaction code SICF.
  Navigate to the relevant service (e.g., sap/bc/soap or similar).
  Ensure that the service is activated. If it is not, activate it.
  
  
  
  Review SSL Configuration:
  
  Check the SSL configuration in transaction STRUST (Trust Manager).
  Ensure that the SSL server and client SSL settings are correctly configured.
  Verify that the necessary certificates are imported and valid.
  
  
  
  Adjust System Parameters:
  
  Check the system parameters related to SSL and certificate requests. You can do this in transaction RZ10 or RZ11.
  Look for parameters like icf/ssl/enable and ensure they are set to allow certificate requests.
  
  
  
  User Authorizations:
  
  Ensure that the user or service account attempting to make the certificate request has the necessary authorizations. This may involve checking roles and profiles assigned to the user.
  
  
  
  Check Logs:
  
  Review the system logs (transaction SM21) and the ICF logs for any additional error messages that might provide more context on the issue.
  
  
  
  Consult Documentation:
  
  Refer to SAP documentation or notes related to SSL configuration and ICF services for any specific instructions or updates that may apply to your version of SAP.
  
  
  
  Related Information:
  
  SAP Notes: Check for any relevant SAP Notes that might address this specific error or provide additional troubleshooting steps.
  SAP Community: The SAP Community forums can be a valuable resource for finding similar issues faced by other users and the solutions they implemented.
  Security Best Practices: Ensure that your SSL/TLS configuration follows best practices for security, including using strong cipher suites and keeping your certificates up to date.
  
  If the issue persists after following these steps, consider reaching out to SAP support for further assistance.