How To Fix TRUST117 - Certificates with this subject and this issuer have been blocked

SAP Error Message - Details

• Message type: E = Error

• Message class: TRUST - Certificate Management

• Message number: 117

• Message text: Certificates with this subject and this issuer have been blocked

What causes this issue?

All certificates with this subject and issuer that were issued before
the specified date are now locally blocked.

System Response

The encryption of messages and the verification of digital signatures is
no longer possible with the affected certificates if the CRL profiles
used for the encryption or signature verification are active. You can
set this in the certificate blocking administration tool.

How to fix this error?

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message TRUST117 - Certificates with this subject and this issuer have been blocked ?

  The SAP error message TRUST117 indicates that a certificate has been blocked due to its subject and issuer being deemed untrusted or invalid in the context of the SAP system's trust management. This typically occurs when the certificate is either self-signed, expired, or not recognized as a valid certificate by the system.
  Cause:
  
  Untrusted Certificate: The certificate's issuer is not in the trusted certificate store of the SAP system.
  Expired Certificate: The certificate has expired and is no longer valid.
  Self-Signed Certificate: The certificate is self-signed and not trusted by default.
  Revoked Certificate: The certificate has been revoked and is no longer valid for use.
  Configuration Issues: The trust relationship between the SAP system and the external system may not be properly configured.
  
  Solution:
  To resolve the TRUST117 error, you can follow these steps:
  
  
  Check Certificate Validity:
  
  Verify if the certificate is expired or revoked. If it is, you will need to obtain a new valid certificate.
  
  
  
  Import the Certificate:
  
  If the certificate is valid but not trusted, you can import it into the SAP system's trust store:
  
  Go to transaction STRUST in the SAP GUI.
  Select the appropriate certificate store (e.g., "SSL Client (Anonymous)" or "SSL Server").
  Import the certificate by clicking on the "Import Certificate" button and following the prompts.
  
  
  
  
  
  Add to Trusted Certificates:
  
  Ensure that the issuer of the certificate is also trusted. If the issuer's certificate is not present, you may need to import it as well.
  
  
  
  Check Configuration:
  
  Review the configuration settings for the SSL/TLS connections in the SAP system to ensure they are correctly set up.
  
  
  
  Test the Connection:
  
  After importing the necessary certificates, test the connection to ensure that the error is resolved.
  
  
  
  Consult Documentation:
  
  Refer to SAP documentation or support for specific instructions related to your version of SAP and the type of connection you are trying to establish.
  
  
  
  Related Information:
  
  Transaction STRUST: This transaction is used for managing SSL certificates in SAP.
  Certificate Authorities (CAs): Ensure that the certificates you are using are issued by a trusted CA.
  SAP Notes: Check for any relevant SAP Notes that may provide additional guidance or updates related to certificate management and the TRUST117 error.
  
  By following these steps, you should be able to resolve the TRUST117 error and establish a trusted connection in your SAP environment.