We are trying to connect SAP S4HANA to Advanced Event Mesh. There are several blog posts on the subject that detail the steps, but we haven’t been able to get it to work.
The Broker cuts off communication after the handshake:
1.- Can an S4 be connected directly to the AEM without needing the add-on?
2.- When creating the user in the Broker, we use the CN from STRUST’s own certificate. We currently have a wildcard CN: CN=*.xxxx.com. However, we cannot create a user in the Broker with *, so we have created a user named xxxx.com. Is this correct, or do we need to change the certificate in the SAP Strust transaction?
3.- Why do we get Framed TCP client connection to tcp://mr-connection-xxxxxx.messaging.solace.cloud:5671 closed by peer?
By default, the username source is set to the Common Name (CN) from the certificate. Since wildcard characters are not supported in usernames on the AEM broker, you cannot create a user with a value such as *.xxxx.com.
Instead, you can configure a different username source in the Broker Manager. The available options are:
Certificate Thumbprint—the username is computed as the SHA-1 hash over the entire DER-encoded contents of the client certificate.
Common Name—the username is extracted from the certificate’s first instance of the CN attribute in the subject distinguished name (DN).
Common Name Last—the username is extracted from the certificate’s last instance of the CN attribute in the subject DN.
Subject Alternate Name—the username is extracted from the certificate’s other name type of the subject alternative name and must have the Microsoft user principal name (UPN) signature.
User Identifier—the username is extracted from the certificate’s first instance of the user identifier attribute in the subject DN.
User Identifier Last—the username is extracted from the certificate’s last instance of the user identifier attribute in the subject DN.
The error message below may indicate an incorrect or incomplete client certificate authentication configuration on the broker:
“Framed TCP client connection to tcp://mr-connection-xxxxxx.messaging.solace.cloud:5671 closed by peer”
If you continue to experience issues after completing the correct setup, please open a support case and share the relevant logs for further investigation.
Thank you for your response.
The Strust certificate itself only contains the CN with an asterisk (*) and a checksum (SHA1) with the value BE:62:21:55:D5…
I tried switching to “Certificate Thumbprint” and creating a user with that value, but it didn’t work. I created another user with the same value but without the colon (:), and that didn’t work either.
That’s great.
A certificate chain containing the root and intermediate certificates is required when using a certificate signed by a CA.
For a self-signed certificate, there is no certificate chain, as the certificate itself acts as the root certificate.
