topic Re: Configure 9.4 to use Viya in SAS Viya

Configure 9.4 to use Viya

SDV — Wed, 23 May 2018 18:25:02 GMT

We have SAS 9.4m5 and a recently installed & configured Viya 3.3 environment. We are trying to connect 9.4m5 to Viya and following the instructions in The SAS Viya 3.3 Admin Guide, and the Configure SAS 9.4 Clients to Work with SAS Viya section. We'd like for users to be able to use EG to submit code to CAS. Therefore, we are configuring the SAS 9.4 Compute Server to connect with CAS.

We did these steps:

Copied the SAS Viya CA certificates (vault-sas-service-ca.crt) to the SAS 9.4 compute server
Ran the Deployment Manager to add the certificates to the trusted CA bundle for 9.4
- After selecting the certificate vault-sas-service-ca.crt, we get the error:

"Failed to validate the certificate path: Path does not chain with any of the trust anchors. The certificate(s) were validated in the following order:

subject=CN=SAS VIYA Root CA,issuer=CN=SAS VIYA Root CA

subject=CN=SAS VIYA Intermediate CA,issuer=CN=SAS VIYA Root CA

Anyone know why it is complaining about the certificate?

Re: Configure 9.4 to use Viya

alexal — Wed, 23 May 2018 18:39:30 GMT

@SDV,

Because you are using the wrong file. You have to import this file /opt/sas/viya/config/etc/SASSecurityCertificateFramework/cacerts/trustedcerts.pem from SAS Viya server. FYI, in the December 2017 release of SAS 9.4M5 you do not need to do that.

Re: Configure 9.4 to use Viya

SDV — Wed, 23 May 2018 19:22:54 GMT

@alexal I appreciate the reply. I'll try that file.

Re: Configure 9.4 to use Viya

SDV — Wed, 23 May 2018 20:26:33 GMT

I copied the file trustedcerts.pem to the SAS 9.4 server, tried the import of it using deployment manager and get "Certificate file is not Base-64 encoded".

The file came from the viya cacerts directory. I tried to import the cert when it was named trustedcerts.pem and stored in the sas user's home dir, but the deployment manager said it had to be renamed. I renamed it to tcerts.pem, tried to import it and got the error mentioned above.

Re: Configure 9.4 to use Viya

alexal — Thu, 24 May 2018 12:00:06 GMT

@SDV,

Please validate the PEM file using these commands:

openssl x509 -in <PATH_TO_PEM_FILE> -text
openssl verify <PATH_TO_PEM_FILE>

Re: Configure 9.4 to use Viya

SDV — Thu, 24 May 2018 12:15:56 GMT

With a little help from our friends at SAS Technical Support I was able to get the certificate imported. Here are the instructions I was given that allowed me to successfully perform the import:

Edit the trustedcerts.pem file
Copy the two certificates that are labelled as 'SAS VIYA Root CA' & 'SAS VIYA Intermediate CA'
Copy just the two blocks like this, no comments, in the new file

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----

Paste the two certificates into a new file and save as a .pem file

As stated in the SDM panel's text about subject-issuer order with the root cert last, you need the intermediate cert block first, then the root cert block last.
Run the SAS Deployment Manager to import the certificate from the new .pem file

Now, off to create the authinfo file...