topic Re: SSL termination in Application Development and Automation Discussions

SSL termination

Former Member — Thu, 15 Jul 2010 16:22:40 GMT

Hello!

Could ypu help me?

I need to get data from other system (B) (used ssl) to my sap system A via abap webservice.

Another http web service already exists (switching on to https is not planned...) in A.

sap crypt. library is installed. Parameters were added:

ssl/ssl_lib = $(DIR_CT_RUN)/libsapcrypto.so

sec/libsapsecu = $(DIR_CT_RUN)/libsapcrypto.so

ssf/ssfapi_lib = $(DIR_CT_RUN)/libsapcrypto.so

ssf/name = SAPSECULIB

icm/server_port_0 = PROT=HTTP,PORT=80$$,TIMEOUT=60,PROCTIMEOUT=1500

icm/server_port_1 = PROT=HTTPS,PORT=443,TIMEOUT=50,PROCTIMEOUT=1500

wdisp/ssl_encrypt = 0

wdisp/ssl_auth = 1

For configuration SSL-termination of B and using client certificate:

1) I need to create the PSE request for my sap system (not for B host)?

2) To decrypt data I have to create request to CA and order certificate for my system or I can use existing client certificate?

3) After ssl-termination abap application configured on communication via webservice as HTTP?

http://help.sap.com/erp2005_ehp_04/helpdata/EN/a6/f19a3dc0d82453e10000000a114084/frameset.htm

If SAP Cryptolib'll be install on AS (not only on Web Dispatcher) in future, only https we'll be used for webservices?

Thank you!

Antonina

Re: SSL termination

Former Member — Thu, 15 Jul 2010 20:02:34 GMT

You still have variables in the port parameters of the ICM http settings, so if it might just be restarting it in SMICM needed.

I did not look further yet if that is why it does not work?

Cheers,

Julius

Re: SSL termination

mvoros — Thu, 15 Jul 2010 23:40:55 GMT

Hi,

this [how to guide|http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/60b1edfb-2a5c-2d10-2294-d1777056c46a] should help you to set up web dispatcher in SSL termination mode. You need to create PSE used by web dispatcher (check section 3.2). I don't understand what you mean by client certificate in question 2. Yes, your web service needs to be accessible via HTTP if you want to terminate SSL on web dispatcher.

Cheers