How To Fix WSS019 - Signature check failed - WP: &1 SSF_PAB: &2

SAP Error Message - Details

• Message type: E = Error

• Message class: WSS - Web Services Security

• Message number: 019

• Message text: Signature check failed - WP: &1 SSF_PAB: &2

What causes this issue?

The X.509 signature was rejected by the system.

System Response

How to fix this error?

The signature is checked against the STRUST WS Security identity &V1&,
but failed due to:
CRC &V2&:
0 ok
1 failed to find external security library
2 format error
3 wrong input data
4 unsufficient memory for processing
5 signature certificate is not trusted. To trust the signature,
add the certificate (+ chain when issued by an certificate authority) to
the STRUST WS Security Identity &V1&
6 unsufficient memory for results
7 unknown address book
8 wrong password for address book
10 unsupported hash algorithm
11 ASN.1 coding failed
12 ASN.1 decoding failed
13 unknown error in crypto library. Check kernel traces for
details.

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Additional information may be in the kernel traces of work process &V3&.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message WSS019 - Signature check failed - WP: &1 SSF_PAB: &2 ?

  Certainly! Here's a detailed explanation of the SAP error message:
  
  SAP Error Message:
  WSS019 Signature check failed - WP: &1 SSF_PAB: &2
  
  Meaning / Cause:
  This error occurs during the verification of a digital signature in SAP's Secure Store and Forward (SSF) framework. Specifically, the system attempted to verify a signature on a Work Process (WP) using a PSE (Personal Security Environment) or a Public Key Infrastructure (PKI) object identified by SSF_PAB, but the signature check failed.
  Possible causes include:
  
  The digital signature is corrupted or altered.
  The public key or certificate used for verification is incorrect, expired, or missing.
  The PSE (Personal Security Environment) used for signature verification is not properly configured or does not contain the correct certificates.
  The data or document being verified has been changed after signing.
  Mismatch between the signature and the data (e.g., wrong hash algorithm).
  The cryptographic library or SSF configuration is incorrect or incomplete.
  
  
  Where it occurs:
  
  During signature verification in SAP applications that use SSF for digital signatures, such as secure email, document signing, or secure communication.
  Common in scenarios involving signed PDF documents, signed XML, or signed SAP messages.
  
  
  Solution / Troubleshooting Steps:
  
  
  Check the PSE and Certificates:
  
  Verify that the PSE (Personal Security Environment) used for signature verification contains the correct public key certificates.
  Use transaction STRUST to inspect the PSE and ensure the certificates are valid and not expired.
  Import or update the necessary root and intermediate certificates if missing.
  
  
  
  Verify the Signature Source:
  
  Confirm that the signature was created with the corresponding private key matching the public key in the PSE.
  Ensure the data/document has not been altered after signing.
  
  
  
  Check SSF Configuration:
  
  Review the SSF configuration in transaction SSF or SICF (if related to web services).
  Ensure the correct PSE is assigned for signature verification.
  
  
  
  Check for Patch or Kernel Updates:
  
  Sometimes, cryptographic libraries or kernel patches fix bugs related to signature verification.
  Check SAP Notes for any relevant patches or updates.
  
  
  
  Enable Trace for SSF:
  
  Enable trace for SSF to get detailed logs on signature verification.
  Use transaction SSFTRACE or enable trace via profile parameters.
  Analyze the trace to pinpoint the exact failure reason.
  
  
  
  Check Hash Algorithm and Signature Format:
  
  Ensure the signature uses a supported hash algorithm.
  Confirm the signature format matches what SAP expects.
  
  
  
  Recreate or Re-import Certificates:
  
  If certificates are corrupted, recreate or re-import them into the PSE.
  
  
  
  
  Related Information:
  
  
  Transactions:
  
  STRUST — Manage PSE and certificates.
  SSF — Secure Store and Forward configuration.
  SSFTRACE — Trace SSF operations.
  
  
  
  SAP Notes:
  
  Search for notes related to WSS019 or SSF signature verification errors.
  Example: SAP Note 1234567 (hypothetical) might address signature verification issues.
  
  
  
  Documentation:
  
  SAP Help Portal: Secure Store and Forward (SSF) framework.
  SAP Library on Digital Signatures and Cryptography.
  
  
  
  
  Summary:
  
  
  
  Aspect
  Details
  
  
  
  
  Error
  WSS019 Signature check failed
  
  
  Cause
  Signature verification failed due to invalid/corrupt signature, wrong/missing certificates, or misconfiguration of SSF/PSE
  
  
  Solution
  Check and update PSE certificates, verify signature source, review SSF configuration, enable trace, apply patches
  
  
  Tools
  STRUST, SSF, SSFTRACE
  
  
  
  
  If you provide more context (e.g., which transaction or scenario triggers this error), I can help tailor the solution further.