3573178 - Error when running SWPM Tool - Still missing, content has been tampered, CRL is outdated, ERROR: CRL is enforced by SAPINST_ENFORCE_CRL

Description

Symptom

• An error occurs when trying to run the SWPM 1.0 or 2.0.
• The content has been tampered with and must not be used
• Still missing - e.g. SAPEXE.SAR, SAPEXEDB.SAR, ISGEXE.SAR, IGSHELPER.SAR is "Still missing", kernel media
• Dependency is missing
• SAPCAR: error during certificate revocation check (error 61). SSF-RC: SSF_API_CRL_OUTDATED 
  Detail: CRL is outdated (CurrentTime>CRL.nextUpdate). 
• The error message indicates a connection issue to the SAP backend server during the downloading of crlbag.p7s
• ERROR: CRL is enforced by SAPINST_ENFORCE_CRL, but the CRL path '/root/.sapinst/crlbag.p7s' does not exist.
• Downloading CRL to /root/.sapinst/crlbag.p7s.tmp failed with 3. Output:
  Download (no proxy)
  org.apache.hc.client5.http.ConnectTimeoutException: Connect to https://tcs.mysap.com:443 [tcs.mysap.com/155.56.80.72] failed: connect timed out (local port ### to address ###), remote port 443 to address 155.56.80.72 (tcs.mysap.com))
• Verifying signature of DU at '/<Path of SWPM>/'Verification of DU manifest at '/<Path of SWPM>/SIGNATURE.SMF' failed.
• Checking '/migration/SAPEXE_<XXXXXXX>.SAR' failed, archive not accepted. 

Environment

• Software Provisioning Manager 1.0, 2.0

Reproducing the Issue

1. Start the SWPM Tool.
2. Encounter the error message.

Cause

From sapinst version 753.0.10, there is a security improvement: SAPinst will enforce the availability of a valid CRL file and stop if is not available - 3207613 - SAPinst Framework 7.53 Central Note 

One possible cause: connection problem to the SAP backend server to download the required CRL file.

Resolution

1. Download the file from "https://tcs.mysap.com/crl/crlbag.p7s".
2. Copy the downloaded file to the affected server in binary mode.
3. Restart the Software Provisioning Manager (SWPM) with the parameter:
   ./sapinst SAPINST_CRL_PATH=<path and filename of the downloaded crlbag.p7s> (on Linux/Unix, for example:./sapinst SAPINST_CRL_PATH=<local path of the file on the issue server>/crlbag.p7s)
   sapinst.exe SAPINST_CRL_PATH=<path and filename of the downloaded crlbag.p7s> in a CMD (on WIN OS, for example: sapinst.exe SAPINST_CRL_PATH=<local path of the file on the issue server>/crlbag.p7s)
   with a new option and not with continue old option.

See Also

Refer to SAP Note 3207613 - SAP Framework 7.53 Central Note for more information.

Keywords

Still missing, SAPEXE.SAR, SAPEXEDB.SAR, ISGEXE.SAR, IGSHELPER.SAR, SWPM 1.0 , SWPM 2.0, error, connection issue, SAP backend server, SAPINST_CRL_PATH, SAP Framework 7.53 Central Note, ERROR: CRL is enforced by SAPINST_ENFORCE_CRL, but the CRL path '/root/.sapinst/crlbag.p7s' does not exist, Verifying signature, SIGNATURE.SMF' failed, The content has been tampered with and must not be used, content has been tampered, SSF-RC: SSF_API_CRL_OUTDATED,  CRL is outdated, CurrentTime>CRL.nextUpdate, Integrity of archive file  at, could not be verified, signature type could not be determined, error during certificate revocation check, Dependency is missing, Not found, archive not accepted, manifest file