Using SAP Single Sign-On with X.509 certificates and when logging on to SAP GUI you see error below. The error can also happen in a scenario involving trusted SNC connection between two systems.

If you encounter the error “peer certificate validation failed”, then check, that you have imported the ‘own certificate’ of the partner SAP system (of the SNC SAPCryptolib Keystore) into the PSE Keystore of your Simplifier instance.

A2210223: Server does not trust my certificate path → Solution: Users need to login with Window main password at least once to established connection Cause of this issue is “Trust is not established between the SAP server and the client X.509 certificate”.

The vendor has a certificte chain with Root, intermediate and child certificates which need to be installed. Our connection was successfully working untill last week when the child certificate got expired and we had to install the update one. Since then we are not able to establish the connection.

The answer is: Check your technical account that is used for SAP Kerberos SSO. It might be locked in MS Active Directory. In my case, this account was simply locked by AD security script. This entry was posted in SAP.

To resolve this error confirm that the certificate has been created and imported properly on the Secure Agent machine and on the SAP server. Refer to the following helpful SAP article regarding how to troubleshoot this error:

The line highlighted in red, contains the exact Peer's certificate that should be imported into the PSE that is highlighted in blue. However, it is recommended that you import the Root CA of the missing certificate instead of the certificate itself.

A2200223 Peer certificate path not trusted. The certificate verification failed because the certificate path is not complete (CA certificate is missing), or the root certificate is not trusted.

Import the certificate in STRUSTSSO2, then create a HTTP destination in SM59 for your service. Assign the client certificate there. Test the connection in SM59. If it doesn't work, talk to your BASIS people. It's a very common setup for them. Once the connection is successful, write your ABAP program using the destination.

A2200223 Peer certificate path not trusted. The certificate verification failed because the certificate path is not complete (CA certificate is missing), or the root certificate is not trusted.