SSL Certificate Management

Overview

Secure Sockets Layer (SSL) / Transport Layer Security (TLS) relies on valid X.509 certificates for encrypted HTTPS communication between the Syniti Knowledge Platform (SKP) and SAP systems. Authentication is handled through the SAP Internet Communication Framework (ICF), which processes HTTPS requests and validates client certificates presented during the SSL handshake. This section provides comprehensive guidance on managing the complete SSL certificate lifecycle, including generation, deployment, rotation, and troubleshooting.

• UserPassword (Basic Auth) with HTTPS: Upload only the server certificate from SAP into the SKP. Refer to the Server Certificate Setup section for more information.

• Certificate (Mutual TLS) with HTTPS: Complete the following steps to configure and manage SSL certificates:

  1. Client Certificate Setup

  2. Server Certificate Setup

Before setting up SSL certificate management, the following must be configured:

• The Use HTTPS toggle must be turned on in SAP NetWeaver HTTP connection properties.

• HTTPS Connection: SSL must be enabled on the SAP system and a valid SSL server certificate must be present in the SSL Server Standard PSE in STRUST. Refer to SAP Note 510007 for system-level SSL configuration guidance.

Client Certificate Setup

SKP Client Certificate Generation

To generate a new client certificate:

1. In the SKP, open the SAP NetWeaver connection and access the SSL Certificate Setup section.

   Note

   Ensure that the Use HTTPS toggle is turned on.

2. Click Generate new client certificate to create a new Personal Security Environment.

3. Enter a descriptive name for the certificate.

4. Click Generate client certificate to create the certificate. The SKP client certificate is now generated and selected.

5. Copy the client certificate Distinguished Name (DN) that is shown below the selected certificate (it usually has the format "CN="dc-http-crt_xxx", O=Syniti, C=US").

6. Click Download Root CA to save the certificate.

Configure the ICM for Client Certificate Authentication in SAP

The Internet Communication Manager (ICM) must be configured in SAP to accept client certificates over HTTPS. Refer to SAP Help: icm/HTTPS/verify_client for more information.

1. In SAP, access the SMICM transaction and select Goto > Parameters > Change.

2. Set the profile parameter icm/HTTPS/verify_client to 1 (accept client certificates).

3. Restart the ICM to apply the change: go to Administration > ICM > Restart > Yes.

Import SKP Certificate in SAP

Once SKP has generated its client certificate, import it into the SAP SSL Server Standard PSE so that SAP can authenticate the SKP connection over HTTPS.

1. In SAP, access the STRUST transaction.

2. In the left panel, expand the tree and select the SSL Server Standard node. Open it in Change (Edit) mode.

3. Click the Import Certificate button. An Import Certificate dialog box is displayed.

4. Import the downloaded SKP root certificate and click Save. The certificate details are displayed.

5. While in edit mode, click Add to Certificate List. The newly added certificate appears in the Certificate List.

6. Click Save.

Configure the ICF Service for SSL Client Certificate Logon

Configure the relevant SAP ICF service to require SSL client certificate authentication. Refer to SAP Help: Logon with SSL Certificate for more information.

Configure User Mapping for X.509 Client Certificates

Map the SKP client certificate's DN to a valid SAP user account. This allows SAP to identify the connecting user from the certificate presented during the SSL handshake. Refer to SAP Help: X.509 Client Certificate Authentication Method for more information.

Server Certificate Setup

Export the SAP SSL Server Certificate

Export the SAP server certificate from the SSL Server Standard PSE so it can be uploaded into the SKP to establish trust.

1. In SAP, access the STRUST transaction.

2. In the left panel, select the SSL Server Standard node.

3. In the Own Certificate section, select the SSL certificate and click Certificate > Export. An Export Certificate dialog box is displayed.

4. Assign a name that identifies the SAP system the certificate came from.

5. Select the Base64 option and click Continue. The SAP SSL server certificate is now downloaded.

Upload SAP Server Certificate in the SKP

1. Open the SKP > SAP NetWeaver HTTP connection and access the the SSL Certificate Setup section.

2. Click Select Server Certificate to open Select SAP Server Certificate dialog box.

3. Click the Upload New Certificate tab to upload the downloaded certificate from SAP and click Confirm.

4. Select the exported certificate file and click Save.

5. Click Test Connection to verify the connection status.

6. Click Save to complete the SAP NetWeaver HTTPS connection configuration.

Certificate Rotation Workflow

As a security best practice, rotate SKP client certificates at regular intervals. To rotate certificates without service interruption:

1. Initiate Rotation: Modify the existing SAP NetWeaver HTTP connection in the SKP and click Rotate Client Certificate. A new certificate version (v2) is generated while v1 remains active.

   Note

   If you interrupt the certificate rotation process, the newly generated certificate will be marked as Transitioning. You can resume using the Continue Rotation button.

2. Download New Certificate: Download the new v2 certificate from SKP.

3. Import New Certificate into SAP: In STRUST, import the new v2 client certificate into the SSL Server Standard PSE's Certificate List alongside the existing v1 certificate so both coexist during transition.

4. Update User Mapping: If the Distinguished Name (DN) has changed in the new v2 certificate, add a new entry in the VUSREXTID view (via SM30) reflecting the updated DN. Both v1 and v2 DN entries can coexist during the transition period.

5. Test Connection: Verify the connection still works in SKP using both the old and new credentials.

6. Activate New Certificate: In the SSL Certificate Setup section, click View Versions, select the v2 certificate version, and then click Save to make it the primary certificate.

7. Cleanup: You can remove any unused certificates marked as Deprecated in the SKP Admin module's Certificates page.

Note

During certificate rotation, both the old and new certificates must coexist in the SAP SSL Server Standard PSE and have corresponding user mapping entries in VUSREXTID. Removing the old certificate or its mapping before the new one is fully activated will cause connection failures and service interruption.

Certificate Metadata Management

You can update certificate name and description in the SKP without regenerating the certificate.

1. Access the SSL Certificate Setup section and click Edit Metadata.

2. Update the name or description and click Save.

The certificate identity and key information remain unchanged.

Troubleshoot SSL Certificate Setup

Related Articles

Connecting to SAP Systems Using SAP NetWeaver HTTP