How To Fix TRUST071 - PSE has incorrect Distinguished Name

SAP Error Message - Details

• Message type: E = Error

• Message class: TRUST - Certificate Management

• Message number: 071

• Message text: PSE has incorrect Distinguished Name

What causes this issue?

The PSE's own certificate has an incorrect Distinguished Name (DN).
The PSE cannot therefore be used for the selected application.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

In the case of the "SNC (SAPCryptolib)" PSE, the DN must correspond to
the profile parameter <ZH>snc/identity/as</>.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message TRUST071 - PSE has incorrect Distinguished Name ?

  The SAP error message TRUST071 indicates that there is an issue with the Personal Security Environment (PSE) in relation to its Distinguished Name (DN). This error typically arises when the DN in the PSE does not match the expected format or values, which can lead to issues with secure communications, such as SSL/TLS connections.
  Cause:
  
  Incorrect DN Format: The Distinguished Name in the PSE may not be formatted correctly or may contain invalid characters.
  Mismatch: The DN in the PSE may not match the DN expected by the system or the certificate being used.
  Expired or Invalid Certificates: If the certificates associated with the PSE are expired or invalid, it can lead to this error.
  Configuration Issues: There may be misconfigurations in the trust relationships or the PSE settings.
  
  Solution:
  To resolve the TRUST071 error, you can follow these steps:
  
  
  Check the PSE Configuration:
  
  Use transaction STRUST to access the PSE.
  Verify the Distinguished Name (DN) in the PSE. Ensure that it is correctly formatted and matches the expected values.
  
  
  
  Update the DN:
  
  If the DN is incorrect, you can update it by editing the PSE. Make sure to follow the correct format for the DN, which typically includes attributes like CN (Common Name), O (Organization), OU (Organizational Unit), L (Locality), ST (State), and C (Country).
  
  
  
  Regenerate Certificates:
  
  If the certificates are expired or invalid, consider regenerating them. You can do this in the STRUST transaction by creating a new certificate request and then importing the new certificate once it has been signed by a Certificate Authority (CA).
  
  
  
  Check Trust Relationships:
  
  Ensure that the trust relationships are correctly set up. This includes checking that the root and intermediate certificates are correctly imported into the PSE.
  
  
  
  Test the Configuration:
  
  After making changes, test the configuration to ensure that the error is resolved. You can do this by attempting to establish a secure connection that previously failed.
  
  
  
  Consult Documentation:
  
  Refer to SAP documentation or notes related to the specific version of SAP you are using for any additional guidance or troubleshooting steps.
  
  
  
  Related Information:
  
  Transaction STRUST: This transaction is used to manage the PSE and certificates in SAP.
  PSE Types: There are different types of PSEs in SAP, such as the SSL PSE, which is used for secure communication.
  SAP Notes: Check for any relevant SAP Notes that may provide additional insights or solutions related to the TRUST071 error.
  
  If the issue persists after following these steps, consider reaching out to SAP support for further assistance.