Implementing SSL using Wildcard certificate on S4HANA_Fiori_WebDispatcher

 

Wildcard certificate generation for SAP systems & SSL using WC on S4HANA_Fiori_WebDispatcher

1-What is wild card certificate:

A SSL Wildcard certificate is a single certificate with a wildcard character (*) in the domain name field. This allows the certificate to secure multiple sub domain names (hosts) pertaining to the same base domain.

2-Format of the Wildcard certificate

A {SSL} Wildcard certificate should be considered an option when looking to secure a number of sub domains, such as “secure.<domainname>.com”, “www.<domainname>.com” with a single certificate.The format of the common name entered for the SSL Wildcard Certificate will be '*.(domainname).com'.

3-Prerequisite

1.       Login to OS level as sidadm

2.       Check the SHELL then manually change the SHELL file (csh or bsh) 

3.       Check environment variable (SECDIR) is set or not by executing sapgenpse 

4.       Environment variable is not set so set the env 

5.       Again, execute the command sapgenpse and check

6.       The output will looks like 

 

How to generate the Wildcard certificate

1.      Create the SHA2 certificate & certificate response for CA signing authority with below Execute - (As per the requirement here the requirement was SHA-256 Key Length 4096 ) 

sapgenpse get_pse -a sha256WithRsaEncryption -s 4096 -p ssl-credentials.pse -r ssl-credentials.req -x <password> "CN=*.domainname.com, O=organization name, C=country"

Two entries got created: ssl_credentials.pse & ssl_credentials.req

 

3.       Export entries to private key & certificate format which will be imported

Create sso logon for PSE

Execute– sapgenpse seclogin –p ssl-credentials.pse –O sidadm –x <password>

Create Certificate file to be imported into NWA/ABAP

Execute – sapgenpse export_own_cert -o ssl-credentials-cert.crt -p ssl-credentials.pse

Execute - sapgenpse export_p12 -p ssl-credentials.pse ssl-credentials.p12

4.       Check the other two created entries: ssl-credentials-cert.crt & ssl-credentials.p12

  Transfer files ssl-credentials.req , ssl-credentials-cert.crt & ssl-credentials.p12 to Jump Server via Winscp.

6.       Open the ssl-crerdentials.req file and save as .csr file. Check the ssl-credentails.csr file and it should have Algorithm as SHA256, key length here 4096 (you can generate as per your requirement) and common domain name <CN entry = *.domain.com>

7.       Send this file – ssl-credentials.csr to for CA signed.

Need to generate the PSE from the signed PKCS#12 or PFX file

2148457 - How to convert the keypair of a PKCS#12 / PFX container into a PSE file

Steps :

1.Set the environment variable : SAPGENPSE

SECUDIR=/usr/sap/SID/<instant>/sec

export SECUDIR

for permanent change :

setenv SECUDIR /usr/sap/SID/<instance>/sec

Run the command : sapgenpse from SIDADM

2.Convert the .PFX file to .PSE

sapgenpse import_p12 -p <New>.pse communication-partner-supplied.pfx

Procedure to apply the wildcard certificate in Web dispatcher

1.Shutdown the SAP Web dispatcher .

2.Take the backup of the existing SAPSSLS.pse to SAPSSLS.psc_baclup

3.Places the earlier created <New>.pse in the location /use/sap/SID/<IN>/sec

4.Rename the <New>.pse to SAPSSLS.pse 

5. Start the SAP Web dispatcher.

Procedure to apply the wildcard certificate in  S/4 HANA

1.Once the new.pse will generate as per the above step .

2.Login to the S4/H system

3.Tcode : strustsso2

4.Client : 000

5.Delete the existing SSL server standard certificate ( As Its not signed Certificate)

6.Now import the wild card certificate which was created with the name <New>.pse

Select SSL server standard à PSE à Import

 

Once Saved this will reflect as trusted

 

Procedure to apply the wildcard certificate in Fiori

1.Login to the Fiori system

2.Tcode : strustsso2

3.Client : 000

4.Delete the existing SSL server standard certificate ( As Its not signed Certificate)

5.Now import the wild card certificate which was created with the name <New>.pse

Select SSL server standard à PSE à Import

Once Saved this will reflect as trusted

Completed. :) 

Please provide your valuable feedback.