How To Fix TRUST101 - Certificate with subject key identifier &1 already exists

SAP Error Message - Details

• Message type: E = Error

• Message class: TRUST - Certificate Management

• Message number: 101

• Message text: Certificate with subject key identifier &1 already exists

What causes this issue?

There is already another certificate in the address book with the
subject key identifier &V1&. It is therefore not possible to add this
certificate to the address book.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

In the menu of the <DS><DS:TRAN.STRUST>Trust Manager</></>, call the
address book and check whether you want to continue to use the
certificate with the subject key identifier &V1&.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message TRUST101 - Certificate with subject key identifier &1 already exists ?

  The SAP error message TRUST101 indicates that there is a duplicate certificate in the system with the same subject key identifier. This typically occurs when you are trying to import a certificate that already exists in the system's trust store.
  Cause:
  The error is caused by the following:
  
  You are attempting to import a certificate that has the same Subject Key Identifier (SKI) as an existing certificate in the SAP system.
  This can happen if the same certificate is imported multiple times or if there are multiple certificates with the same SKI due to misconfiguration or incorrect imports.
  
  Solution:
  To resolve the TRUST101 error, you can follow these steps:
  
  
  Check Existing Certificates:
  
  Go to the transaction code STRUST in your SAP system.
  Navigate to the appropriate trust store (e.g., "SSL Client (Standard)" or "SSL Server (Standard)").
  Look for the certificate with the same Subject Key Identifier (SKI) that is causing the conflict.
  
  
  
  Remove or Replace the Existing Certificate:
  
  If the existing certificate is no longer needed, you can delete it from the trust store.
  If you need to keep the existing certificate, you may need to replace it with the new one. Ensure that the new certificate is valid and correctly configured.
  
  
  
  Import the Certificate Again:
  
  After removing or replacing the existing certificate, try importing the new certificate again.
  Ensure that you are importing the correct certificate and that it is not a duplicate.
  
  
  
  Check for Other Trust Stores:
  
  If you are using multiple trust stores (e.g., for different clients or systems), ensure that the certificate is not duplicated across those stores.
  
  
  
  Verify Configuration:
  
  Ensure that your SSL/TLS configuration is correct and that you are not inadvertently importing the same certificate multiple times.
  
  
  
  Related Information:
  
  Transaction STRUST: This is the main transaction for managing SSL certificates in SAP. You can view, import, and delete certificates from here.
  Subject Key Identifier (SKI): This is a unique identifier for a certificate, which is derived from the public key. It is used to prevent duplicate certificates.
  SAP Notes: Check for any relevant SAP Notes that may provide additional guidance or updates related to certificate management and the TRUST101 error.
  
  If the issue persists after following these steps, consider reaching out to SAP support for further assistance, as they may have additional insights or solutions based on your specific system configuration.