How To Fix TRUST157 - On server &1, &2 applies

SAP Error Message - Details

• Message type: E = Error

• Message class: TRUST - Certificate Management

• Message number: 157

• Message text: On server &1, &2 applies

What causes this issue?

The specified maximu protection level for this server is only used if
the PSE mode for the system or this server has been set to the value
"Protected". If the system or the server are unprotected, the PSE files
are not protected.
The protection level means:
Fallback: The PSE files are not unprotected, but the protection is
dependent on the server.
DPAPI: The PSE files are protected using the Microsoft Windows Data
Protection API (DPAPI).
TPM: The PSE files are protected using the Trusted Platform Module
(TPM). TPM is used, for example, on many Linux platforms.
Both DPAPI and TPM use server-dependent protection. This protection can
only be removed on the server on which the file was protected.
If the server has TPM but this is not active, this can be a reason for
the protection level fallback.

System Response

The system determines the protection level and displays it in the server
row. If you double-click the protection level, the corresponding message
is displayed.

How to fix this error?

To protect PSE files, you must first set the entire system or the server
to "Protected". To do this for the system, set the field in the "System"
area to "Protected". For a server, use the context menu, or select the
server and choose "Change PSE Mode".
On Microsoft Windows servers, DPAPI is available without specific
activation. As soon as you set the PSE mode "Protected", the PSE files
are protected with DPAPI.
On Linux servers, the way in which TPM is activated depends on the
platform. It can be necessary to activate TPM in the BIOS. Whether you
need to perform additional administrative steps is also
platform-dependent.
As soon as TPM is active, the PSE files are protected using TPM. The
activation of TPM can improve the protection. PSE files with protection
using TPM can only be read again on the same server.
If TPM is not active, the protection is performed using the fallback
mode. This protects PSE files regardless of the server.

Procedure for System Administrators

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message TRUST157 - On server &1, &2 applies ?

  The SAP error message TRUST157 typically indicates an issue related to the trust relationship between the SAP system and the certificate or key used for secure communications. This error often arises in the context of SSL (Secure Sockets Layer) or secure network communications.
  Cause:
  The error message "TRUST157 On server &1, &2 applies" usually means that the system is unable to establish a secure connection because the trust relationship is not properly configured. This can happen due to several reasons, including:
  
  Missing or Invalid Certificates: The server's SSL certificate may not be trusted by the client or may have expired.
  Incorrect SSL Configuration: The SSL settings in the SAP system may not be correctly configured.
  Certificate Chain Issues: The complete certificate chain may not be available or properly configured.
  Hostname Mismatch: The hostname in the certificate does not match the hostname of the server.
  
  Solution:
  To resolve the TRUST157 error, you can follow these steps:
  
  
  Check Certificates:
  
  Ensure that the SSL certificate used by the server is valid and not expired.
  Verify that the certificate is correctly installed on the server.
  
  
  
  Import Certificates:
  
  If the certificate is not trusted, you may need to import the server's certificate into the trust store of the client system.
  Use transaction STRUST in the SAP GUI to manage SSL certificates. You can import the necessary certificates into the appropriate trust store (e.g., SSL Client (Standard) or SSL Server (Standard)).
  
  
  
  Verify SSL Configuration:
  
  Check the SSL configuration settings in the SAP system. Ensure that the SSL protocol is enabled and configured correctly.
  Review the settings in transaction RZ10 for profile parameters related to SSL.
  
  
  
  Check Hostname:
  
  Ensure that the hostname in the SSL certificate matches the hostname of the server. If there is a mismatch, you may need to obtain a new certificate with the correct hostname.
  
  
  
  Restart Services:
  
  After making changes to the certificates or configuration, restart the relevant SAP services to apply the changes.
  
  
  
  Consult Logs:
  
  Check the SAP system logs (transaction SM21) and the SSL trace logs for more detailed error messages that can provide additional context for troubleshooting.
  
  
  
  Related Information:
  
  SAP Notes: Check for relevant SAP Notes that may provide additional guidance or patches related to SSL and trust issues.
  Documentation: Refer to the official SAP documentation on SSL configuration and trust management for detailed steps and best practices.
  Support: If the issue persists, consider reaching out to SAP support for further assistance.
  
  By following these steps, you should be able to resolve the TRUST157 error and establish a secure connection between your SAP systems.