blocks|key|1020795|text|编辑:随着更多细节的出现，修改后的答案能更好地解决问题。请注意:这是带有SSL的HTTP客户端(而不是服务器)的ABAP。这也是一个非典型的问题。在这里，SAP系统必须使用特定的客户端证书连接到另一个服务，以建立SSL连接。通常在网络级别上管理的东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1020796|加载证书时，必须将其加载到客户端PSE区域的STRUST中。|1020797|前面的想法(在编辑/返工之前)将证书作为标题发送，将其解释为选项3。|1020798|备选方案：|1020799|1)+ABAP中的SSL握手。试图在ABAP中管理SSL握手很可能是不可能的。SSL握手由皂苷sapcryptolib管理。|offset|length|style|BOLD|1020800|2)将STRUST中的客户端证书导入标准客户端。详情见下文|1020801|(+3)使用xxxx.cer作为字符串，并将其添加为Http报头(最后一种方法，如果选项2不起作用)|1020802|==============================================================|1020803|2)选项2--详细信息(最佳方法)--将您的证书导入到Standard中。|1020804|下面是一个实际案例的标准sap+docu的示例。这是荷兰公司的薪资界面。使用私钥证书。*.p12或*.pfx文件。私钥证书|1020805|SPV/491c29ac9232469bb257a2ba14ac290c/999ad0ce8bd24945b547584e776e9a4e.html|1020806|由于这种类型的证书不能直接导入到SAP中，所以它解释了如何在操作系统级别上使用sapgenpse将p12转换为pse文件。Strust不支持导入p12文件。|1020807|现在ABAP调用使用在此步骤中创建的客户端标识。|1020808|+cl_http_client=>create_by_url(
++++++++++++EXPORTING
++++++++++++++url++++++++++++++++=+'url'+++++++++++
++++++++++++++ssl_id+++++++++++++=+'CL_ID'+"Ident+created+in+step+above++
++++++++++++IMPORTING
++++++++++++++client+++++++++++++=+lo_client+++++++
++++++++++).|code-block|syntax|javascript|1020809|或者更容易相处。使用Sm59创建和外部http并选择这个新创建的标识。|1020810|📷|atomic|1020811|​|1020812|然后调用通过目的地创建的http客户端。|1020813|CALL+METHOD+cl_http_client=>create_by_destination
++EXPORTING
++++destination++++++++++++++=+lv_destination+"the+new+sm59+destination+
++IMPORTING
++++client+++++++++++++++++++=+lo_http_client.|1020814|选项3细节：(不理想，假设被调用的服务支持它)。当且仅当，被调用的服务支持证书作为标头注您的xxx.cer是等效的标识密钥。小心地管理绳子。
数据:+lo_client类型REF到if_http_client。cl_http_client=>create_by_url(导出url+=+'url‘ssl_id+=+'ANONYM’“以匿名SSL导入客户端=+lo_client开始SSL握手)。|ordered-list-item|1020815|“并将实际标识作为HTTP报头传递，”许多服务支持这种方法。但他们的解决方案总是“特定于该服务”。示例是microsoft翻译服务。“期望用户订阅键作为标题。'https://api-eur.cognitive.microsofttranslator.com/translate?api-version=3.0‘|1020816|lo_client->request->set_header_field(
++++++EXPORTING
++++++++name++=+'Client-Cert'++++"Check+HTTP+header+name+with+called+Service+docu
++++++++value+=+'<cert>+in+string+format'
++++).
++++
++++"lo_client->send(+..+)
++++"lo_client->receive(+..+)|1020817|entityMap|0|LINK|mutability|MUTABLE|url|https://help.sap.com/docs/ERP_HCM_SPV/491c29ac9232469bb257a2ba14ac290c/999ad0ce8bd24945b547584e776e9a4e.html|1|IMAGE|IMMUTABLE|imageUrl|https://developer.qcloudimg.com/http-save/yehe-900000/b3cc0d03d209938340d0d2311a0b5d87.png|imageAlt|2|https://api-eur.cognitive.microsofttranslator.com/translate?api-version=3.0^0|0|0|0|0|0|F|0|0|9|0|2|U|0|0|0|J|0|0|0|22|0|0|0|0|0|0|0|1|1|0|0|0|0|0|28|23|2|0|0^^$0|@$1|2|3|4|5|6|7|26|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|27|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|28|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|29|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|2A|8|@$J|2B|K|2C|L|M]]|9|@]|A|$]]|$1|N|3|O|5|6|7|2D|8|@$J|2E|K|2F|L|M]]|9|@]|A|$]]|$1|P|3|Q|5|6|7|2G|8|@$J|2H|K|2I|L|M]]|9|@]|A|$]]|$1|R|3|S|5|6|7|2J|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|2K|8|@$J|2L|K|2M|L|M]]|9|@]|A|$]]|$1|V|3|W|5|6|7|2N|8|@]|9|@]|A|$]]|$1|X|3|Y|5|6|7|2O|8|@]|9|@$J|2P|K|2Q|1|2R]]|A|$]]|$1|Z|3|10|5|6|7|2S|8|@]|9|@]|A|$]]|$1|11|3|12|5|6|7|2T|8|@]|9|@]|A|$]]|$1|13|3|14|5|15|7|2U|8|@]|9|@]|A|$16|17]]|$1|18|3|19|5|6|7|2V|8|@]|9|@]|A|$]]|$1|1A|3|1B|5|1C|7|2W|8|@]|9|@$J|2X|K|2Y|1|2Z]]|A|$]]|$1|1D|3|1E|5|6|7|30|8|@]|9|@]|A|$]]|$1|1F|3|1G|5|6|7|31|8|@]|9|@]|A|$]]|$1|1H|3|1I|5|15|7|32|8|@]|9|@]|A|$16|17]]|$1|1J|3|1K|5|1L|7|33|8|@]|9|@]|A|$]]|$1|1M|3|1N|5|6|7|34|8|@]|9|@$J|35|K|36|1|37]]|A|$]]|$1|1O|3|1P|5|15|7|38|8|@]|9|@]|A|$16|17]]|$1|1Q|3|-4|5|6|7|39|8|@]|9|@]|A|$]]]|1R|$1S|$5|1T|1U|1V|A|$1W|1X]]|1Y|$5|1Z|1U|20|A|$21|22|23|-4]]|24|$5|1T|1U|1V|A|$1W|25]]]]

EDIT: Reworked answer to better address problem as the more details arise.
NOTE for readers: This is ABAP as HTTP Client (Not server) with SSL.
This is also a non typical problem. Here the SAP system has to connect to another service using a specific Client Certificate to establish an SSL connection. Something that would normally be managed at network level.
When loading The Certificate it must be loaded into STRUST in the client PSE area.
The previous Idea(prior to edit/rework) sending the the Certificate as a header is explained as Option 3.
OPTIONS :
1) SSL Handshake in ABAP .
Trying to manage SSL handshake in ABAP is very likely not possible.
SSL Handshake is managed by sapcryptolib.
2) Import the Client Certificate in STRUST
into the Standard Client PSE. See details below
3) Use xxxx.cer as string and add as Http header
(last resort if, option 2 doesnt Work)
==============================================================
2) Option 2 Details (BEST WAY)
Import your certificate into Strust, in SSL client Standard area.
Here is an example on standard sap docu of an actual example case. It is Dutsch Payroll interface. Using Private key certificate.
*.p12 or *.pfx file . Private Key certificate
<a href="https://help.sap.com/docs/ERP_HCM_SPV/491c29ac9232469bb257a2ba14ac290c/999ad0ce8bd24945b547584e776e9a4e.html" rel="nofollow noreferrer">https://help.sap.com/docs/ERP_HCM_SPV/491c29ac9232469bb257a2ba14ac290c/999ad0ce8bd24945b547584e776e9a4e.html</a>
Since this type of Cert cant be directly imported into SAP it explains how you can use sapgenpse at operating system level to convert the p12 into a pse file. Strust does not support import of p12 files.
Now the ABAP call uses the client identity created in this step.
<pre><code> cl_http_client=&gt;create_by_url(
 EXPORTING
 url = 'url' 
 ssl_id = 'CL_ID' &quot;Ident created in step above 
 IMPORTING
 client = lo_client 
 ).
</code></pre>
Or perhaps easier to work with.
Use Sm59 to create and external http addr and select this
Newly created identity.
<a href="https://i.stack.imgur.com/Zvp2K.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Zvp2K.png" alt="SM59 external destination" /></a>
Then call with http client created via destination.
<pre><code>CALL METHOD cl_http_client=&gt;create_by_destination
 EXPORTING
 destination = lv_destination &quot;the new sm59 destination 
 IMPORTING
 client = lo_http_client.
</code></pre>
<ol start="3">
<li>OPTION 3 Details: (Not ideal, assume called service supports it.)
if and only if, the called service support Certificates as Header
Note you xxx.cer is the equivalent to an identity key.
manage the string carefully.
<pre><code> DATA: lo_client TYPE REF TO if_http_client.

 cl_http_client=&gt;create_by_url(
 EXPORTING
 url = 'url' 
 ssl_id = 'ANONYM' &quot;Start SSL handshake as Anonymous SSL
 IMPORTING
 client = lo_client 
 ).
</code></pre>
</li>
</ol>
&quot;and pass the actual identify as HTTP header,
&quot; Many service support this approach. But they solutions are always
&quot; specific to that service.
&quot; Example is the microsoft translation service.
&quot; the expect a user subscription key as a header.
'https://api-eur.cognitive.microsofttranslator.com/translate?api-version=3.0'
<pre><code>lo_client-&gt;request-&gt;set_header_field(
 EXPORTING
 name = 'Client-Cert' &quot;Check HTTP header name with called Service docu
 value = '&lt;cert&gt; in string format'
 ).
 
 &quot;lo_client-&gt;send( .. )
 &quot;lo_client-&gt;receive( .. )
</code></pre>

blocks|key|1020857|text|使用KeyStore资源管理器工具从客户端密钥和证书创建单个pfx文件。此外，您还可以将客户端证书的链与此工具放在一起。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1020858|在本地系统上使用皂启，并使用以下命令从pfx文件创建一个pse文件：|1020859|sapgenpse+import_p12+-p+c:\client.pse+c:\client.pfx|code-block|syntax|javascript|1020860|转到STRUST，在Enviroment->SSL客户端标识处创建您自己的证书存储。我更喜欢这个，因为我不把它们都混合在一起。然后返回到STRUST并选择PSE->Import并选择您的自定义pse文件。然后单击PSE->Save并选择您的自定义标识。|1020861|将站点SSL证书添加到新标识中。|1020862|您可以通过选择新的SSL客户端标识在SM59上尝试新的SSL客户端配置。|1020863|下面是ABAP代码示例。|1020864|REPORT+ZMKY_SSL_CLIENT.

+DATA:+lo_client+TYPE+REF+TO+if_http_client,
+++++++lv_code+++TYPE+i,
+++++++lv_REASON+type+string.

+++cl_http_client=>create_by_url(
+++++EXPORTING
+++++++url++++++++++++++++=+'https://mysslclienthost.com'
+++++++ssl_id+++++++++++++=+'MYSSLC'++++++"Your+SSL+Client+identity
+++++IMPORTING
+++++++client+++++++++++++=+lo_client
+++).

+++lo_client->SEND(+).

+++lo_client->RECEIVE(+).

+++lo_client->RESPONSE->GET_STATUS(+IMPORTING+CODE+=+lv_code
++++++++++++++++++++++++++++++++++++REASON+++++++++=+lv_reason+).

+++WRITE:+lv_code,+lv_reason.|1020865|entityMap|0|LINK|mutability|MUTABLE|url|https://keystore-explorer.org/^0|2|D|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|D|3|E|5|6|7|16|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|17|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|18|8|@]|9|@]|C|$]]|$1|M|3|N|5|6|7|19|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|C|$]]|$1|Q|3|R|5|6|7|1B|8|@]|9|@]|C|$]]|$1|S|3|T|5|H|7|1C|8|@]|9|@]|C|$I|J]]|$1|U|3|-4|5|6|7|1D|8|@]|9|@]|C|$]]]|V|$W|$5|X|Y|Z|C|$10|11]]]]

Use <a href="https://keystore-explorer.org/" rel="nofollow noreferrer">KeyStore Explorer</a> tool to create single pfx file from your client key and certificate. Also you can put chain of the client certificate with this tool.
Use sapgenpse on your local system and create a pse file from pfx file with below command:
<pre><code>sapgenpse import_p12 -p c:\client.pse c:\client.pfx
</code></pre>
Go to STRUST, create your own certificate store at Enviroment-&gt;SSL Client identities. I prefer this for not mixing all of them. Then return to STRUST and chose PSE-&gt;Import and select your custom pse file. Then click PSE-&gt;Save as and select your custom identity.
Add site SSL certificate to your new identiy.
You can try new SSL Client configuration at SM59 with selecting your new SSL Client identity.
Example ABAP code below.
<pre><code>REPORT ZMKY_SSL_CLIENT.

 DATA: lo_client TYPE REF TO if_http_client,
 lv_code TYPE i,
 lv_REASON type string.

 cl_http_client=&gt;create_by_url(
 EXPORTING
 url = 'https://mysslclienthost.com'
 ssl_id = 'MYSSLC' &quot;Your SSL Client identity
 IMPORTING
 client = lo_client
 ).

 lo_client-&gt;SEND( ).

 lo_client-&gt;RECEIVE( ).

 lo_client-&gt;RESPONSE-&gt;GET_STATUS( IMPORTING CODE = lv_code
 REASON = lv_reason ).

 WRITE: lv_code, lv_reason.
</code></pre>

I'm trying to consume an endpoint from ABAP, by instantiate a <code>if_http_client</code> from <code>cl_http_client=&gt;create_by_url</code>. That process works fine when I don't need to use a signed certificate. Usually I just include the certificate using the <code>STRUST</code> transaction.
But for this specific case I have two certificate files: <code>.crt</code> and the <code>.key</code>. I'm able fetch the endpoint from <code>Postman</code>, because I can insert those files in <code>Settings -&gt; Certificates</code>:
<a href="https://i.stack.imgur.com/GFh6m.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/GFh6m.png" alt="enter image description here" /></a>
So, how can I have it working from ABAP? How to insert those files in my http request? Should I pass them from ABAP code, or config it in STRUST or some other transation?

Calling HTTP endpoint using .CRT and .KEY files in ABAP?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我试图通过从if_http_client实例化cl_http_client=>create_by_url来使用ABAP的端点。当我不需要使用经过签名的证书时，这个过程可以正常工作。通常，我只包含使用STRUST事务的证书。但是对于这个特殊情况，我有两个证书文件：.crt和.key。我可以从Postman获取端点，因为我...

问使用ABAP中的.CRT和.KEY文件调用HTTP端点？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用ABAP中的.CRT和.KEY文件调用HTTP端点？EN