ABAP Agent not reporting to Controller (error: WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED)

Owned by Tomas Tazky (Unlicensed)
Sept 06, 2022
2 min read

Symptoms

Abap agent does not report any data to the Controller on Windows installation.

Below errors in C++ SDK logs:

2022-08-28 02:49:01.096797| 2|agent| Backend Config 2.0 support disabled, this agent will use legacy backend config
2022-08-28 02:49:01.143665| 4|httpclient| request had HTTP exception: SSL error: WINHTTP_CALLBACK_STATUS_FLAG_CERT_REV_FAILED failed to check revocation status.
2022-08-28 02:49:01.143665| 3|agent| Agent configuration update error {http status 0}
2022-08-28 02:50:01.102496| 3|agent| Connection back off limitation in effect for config request




Solution

Answer to a customer may be following:

It indicates that the certificates required for an SSL communication issued by DigiCert certification authority, cannot be validated against CRL Distribution Point and that's the reason why they are revoked.
CRL Distribution Point URIs beam to the files containing the list of revoked certificates. Please check from your SAP system OS (simply via browser by putting URIs to the address field) whether these *.crl resources are accessible or not. If they aren't, check your network configuration and identify what could prevent your system from accessing them. It could be a firewall (local on your system OS or dedicated server), proxy, gateway, …

http://crl3.digicert.com/ssca-sha2-g6.crl
http://crl4.digicert.com/ssca-sha2-g6.crl

Ensure that above URIs are accessible from SAP application server(s) OS.

Steps to do:

  1. Check and verify with the network team of the customer and on which specific type of network proxy is being used:

- SSL-based without a username and password

- SSL-based with a username and password

- nonSSL-based with a username but password-less

- nonSSL-based with a username but with a password

2. Verify if the respected CRL URLs (http://crl3.digicert.com/ssca-sha2-g6.crl/http://crl4.digicert.com/ssca-sha2-g6.crl) have been whitelisted on the network proxy side;

3. To check the connectivity to the respected CRL URLs (http://crl3.digicert.com/ssca-sha2-g6.crl/http://crl4.digicert.com/ssca-sha2-g6.crl) from the Windows Host using some network tool like curl (Windows uses PowerShell and there may not be curl) 

4. Attempt to bypass the network proxy for the connectivity in-between C SDK and the AppD Controller;