How To Fix STRUSTCR050 - Issuer "&1&2" does not match the CRL issuer "&3&4"

SAP Error Message - Details

• Message type: E = Error

• Message class: STRUSTCR - Certificate Revocation Configuration

• Message number: 050

• Message text: Issuer "&1&2" does not match the CRL issuer "&3&4"

What causes this issue?

The issuer did not match the CRL issuer. This issue occurs if an issuer
in the source list of a profile does not match with the issuer of the
CRL that is referenced by the URL.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

Check the corresponding source list entry.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message STRUSTCR050 - Issuer "&1&2" does not match the CRL issuer "&3&4" ?

  The SAP error message STRUSTCR050 indicates a mismatch between the issuer of a certificate and the issuer of the Certificate Revocation List (CRL) that is being checked. This error typically arises in the context of SSL/TLS communications or when dealing with digital certificates in SAP systems.
  Cause:
  The error occurs when:
  
  The certificate being used (the issuer) does not match the issuer of the CRL that is being referenced.
  This can happen if the certificate has been issued by a different Certificate Authority (CA) than the one that issued the CRL.
  The CRL may be outdated or not properly configured in the SAP system.
  There may be a configuration issue in the trust store where the certificates and CRLs are managed.
  
  Solution:
  To resolve the STRUSTCR050 error, you can follow these steps:
  
  
  Check the Certificate and CRL:
  
  Verify the issuer of the certificate that is being used. You can do this by examining the certificate details in the SAP Trust Manager (transaction STRUST).
  Check the issuer of the CRL that is being referenced. Ensure that it matches the issuer of the certificate.
  
  
  
  Update the CRL:
  
  If the CRL is outdated, download the latest CRL from the Certificate Authority (CA) that issued the certificate.
  Import the updated CRL into the SAP system using the Trust Manager (transaction STRUST).
  
  
  
  Configure Trust Relationships:
  
  Ensure that the trust relationships are correctly configured in the SAP Trust Manager. This includes ensuring that the correct root and intermediate certificates are present in the trust store.
  
  
  
  Check for Multiple CAs:
  
  If you are using multiple CAs, ensure that the correct CRL is being used for the corresponding certificate. You may need to manage multiple CRLs if you have certificates from different CAs.
  
  
  
  Test the Configuration:
  
  After making changes, test the SSL/TLS connection or the functionality that was causing the error to ensure that the issue has been resolved.
  
  
  
  Consult Documentation:
  
  Refer to SAP documentation or the specific CA documentation for additional guidance on managing certificates and CRLs.
  
  
  
  Related Information:
  
  Transaction STRUST: This is the SAP transaction used to manage SSL certificates and trust relationships.
  Certificate Authorities (CAs): These are entities that issue digital certificates. Ensure that you are using a trusted CA.
  CRL (Certificate Revocation List): A list of certificates that have been revoked by the CA before their expiration date. It is important to keep this list updated to maintain security.
  
  By following these steps, you should be able to resolve the STRUSTCR050 error and ensure that your SAP system can properly validate certificates and their revocation status.