How To Fix SLDAP_ICM012 - SSL client identity &1 (with PSE file name "&2") cannot be used

SAP Error Message - Details

• Message type: E = Error

• Message class: SLDAP_ICM - ICM LDAP Plugin: Messages

• Message number: 012

• Message text: SSL client identity &1 (with PSE file name "&2") cannot be used

What causes this issue?

The provided SSL client identity &V1& cannot be used to establish a
secure connection.
This check verifies:
For the SSL client identity &V1&, a PSE file name "&V2&" can be created
(when the former content was empty, this step failed).
For the PSE file name "&V2&", exactly one entry can be found in the
database table of PSE file headers (SSF_PSE_H).
For an SSL client identity regularly maintained in transaction STRUST,
those checks should pass.

System Response

The creation of the ICM LDAP plug-in-based connection was canceled.

How to fix this error?

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message SLDAP_ICM012 - SSL client identity &1 (with PSE file name "&2") cannot be used ?

  The SAP error message SLDAP_ICM012 indicates an issue with the SSL client identity, specifically that the SSL client identity cannot be used with the specified PSE (Personal Security Environment) file. This error typically arises in scenarios where SSL/TLS communication is required, such as when connecting to an LDAP server or other secure services.
  Causes:
  
  Invalid or Missing PSE File: The PSE file specified may not exist, may be corrupted, or may not be accessible by the SAP system.
  Incorrect Configuration: The SSL client identity may not be correctly configured in the SAP system, leading to issues when trying to establish a secure connection.
  Certificate Issues: The certificate associated with the SSL client identity may be expired, not trusted, or not properly installed.
  Permissions: The user under which the SAP system is running may not have the necessary permissions to access the PSE file.
  Mismatched SSL/TLS Versions: The SSL/TLS version being used may not be compatible with the server or the client.
  
  Solutions:
  
  
  Check PSE File:
  
  Verify that the PSE file exists at the specified location and is not corrupted.
  Use transaction STRUST in the SAP GUI to check the PSE configuration and ensure that the correct PSE file is being used.
  
  
  
  Recreate PSE:
  
  If the PSE file is corrupted or misconfigured, consider recreating it. You can do this in transaction STRUST by selecting the appropriate options to create a new PSE.
  
  
  
  Update Certificates:
  
  Ensure that the certificates in the PSE are valid and not expired. If necessary, import new certificates into the PSE.
  
  
  
  Check Permissions:
  
  Ensure that the SAP system has the necessary permissions to access the PSE file. This may involve checking file system permissions on the server.
  
  
  
  Review SSL/TLS Configuration:
  
  Check the SSL/TLS settings in the SAP system and ensure they are compatible with the server you are trying to connect to. This may involve adjusting settings in the ICM (Internet Communication Manager) configuration.
  
  
  
  Test Connection:
  
  After making changes, test the connection to the LDAP server or the service you are trying to access to ensure that the issue is resolved.
  
  
  
  Related Information:
  
  Transaction STRUST: This transaction is used to manage SSL certificates and PSE files in SAP.
  SAP Notes: Check for relevant SAP Notes that may provide additional guidance or patches related to SSL issues.
  Documentation: Refer to SAP documentation on SSL configuration and PSE management for detailed steps and best practices.
  
  If the issue persists after trying the above solutions, consider reaching out to SAP support for further assistance, providing them with detailed logs and error messages for better diagnosis.