SAP SQL Anywhere

Question

Hello all,

How can i get the digital signed certificate string of a website ? or is there a way to compare digital signed certificate strings directly from website.

Answer 1

2

SQL Anywhere cannot download an HTTPS remote certificate directly. You need to either have it available already and provide it to SQL Anywhere in your SQL scripts or you can optionally download it dynamically with a separate external client (like openssl s_client) and launch the client from SQL Anywhere (e.g. using xp_cmdshell) and then refer to the client's output.

There are examples on how to use openssl s_client for this purpose elsewhere, but here's a command that worked for myself on Windows:

openssl s_client -showcerts -connect open.sap.com:443 < nul 2> nul | openssl x509 -outform PEM > opensapcom.pem

CREATE OR REPLACE PROCEDURE "DBA"."get_open_sap_com"()
result( "name" varchar(254),"value" long varchar )
url 'https://open.sap.com/'
certificate 'file=c:\\temp\\opensapcom.pem'
type 'http:get';

CALL get_open_sap_com();

permanent link

answered 21 May '15, 17:38

Jeff Albion
10.8k●1●71●175
accept rate: 25%

Comment Text Removed

I have tried your code and get: The secure connection to the remote host failed: The TLS handshake failed, error code 0 SQLCODE -990

I have to use a proxy connection but that seams not to be the problem. This is the Web Client Log

[connid = 6, 05/22 15:07:57.818, PROXY REQUEST]
CONNECT open.sap.com:443 HTTP/1.0
Host: open.sap.com

[connid = 6, 05/22 15:07:57.819, PROXY RESPONSE]
HTTP/1.0 200 Connection established

[connid = 6, 05/22 15:07:57.848, REQUEST]
GET / HTTP/1.0
ASA-Id: 3154dd355b054cd7bcce53b221377cd4
Connection: close
Accept-Charset: windows-1252, UTF-8, *
Date: Fri, 22 May 2015 13:07:57 GMT
User-Agent: SQLAnywhere/16.0.0.2003
Host: open.sap.com

[connid = 6, Error: socket closed by peer]
[connid = 6, socket closed]

The certificate File was generated on a linux host and contains

(22 May '15, 09:16) Thomas Dueme...

Replies hidden

Comment Text Removed

The root certificate should be:

http://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem

You can see this in the regular openssl s_client output:

1 s:/C=US/O=Symantec Corporation/OU=Symantec Trust Network/CN=Symantec Class 3 Secure Server CA - G4 i:/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 2006 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G5

(22 May '15, 11:05) Jeff Albion

So I don't use the .pem File I have created based on you command line? I use the downloaded one ? Or do I have to include both in the .pem 'file=c:\temp\opensapcom.pem' ? Thanks again.

(28 May '15, 10:23) Thomas Dueme...

flat view

SAP SQL Anywhere

Getting Digital certificate of a website

Follow this question

Related questions