topic Re: SYSTEM.PSE replace in Application Development and Automation Discussions

SYSTEM.PSE replace

Former Member — Fri, 14 Dec 2007 18:36:59 GMT

Hello,

I am thinking to use txn.STRUST and replace SYSTEM.PSE to correct current DN in the live system. I am wondering what I have to take into considerations before doing taht and what possibly needs to be fixed/corrected afterwards.

Thanks,

Robert

Re: SYSTEM.PSE replace

Wolfgang_Janzen — Mon, 17 Dec 2007 12:00:34 GMT

Well, you need to be careful when replacing a PSE (= kind of "keystore", containing certificate, private key and list of imported certificates) which has been previously used.

Especially the "System PSE" is critical since it can be used for multiple purposes, e.g. for URL signing, to sign/verify SAP Logon Tickets, to sign application data (-> function module SSFT_PPPI_SIGN), etc.

Only if you are sure that the PSE has never been used before you can replace it without taking any special precautions.

When the PSE was only used for SAP Logon Tickets (SSO2), you have to reestablish the SSO2 trust relationship afterwards.

However, you have to be very careful when this PSE was used to sign data. Replacing the PSE results in the inability to verify the data.

In all cases, it is therefore highly advised to keep a file-copy of the PSE file (which you can re-import using transaction STRUST, if required).

Regards, Wolfgang

Re: SYSTEM.PSE replace

Former Member — Mon, 17 Dec 2007 14:55:56 GMT

Thanks Wolfgang.

After reading your answer got few questions in my mind:

1. I want to correct DN. Can I do it without regenerating key pair ? I guess it should be possible. Do you know how to do that ?

2. You mention backup certificate , you mean using PSE Export ?

Thanks,

Robert

Re: SYSTEM.PSE replace

Wolfgang_Janzen — Mon, 17 Dec 2007 16:34:01 GMT

> 1. I want to correct DN. Can I do it without regenerating key pair ? I guess it should be possible. Do you know how to do that ?

Theoretically you are right. But practically (with the tools provided) that's not possible.

> 2. You mention backup certificate , you mean using PSE Export ?

Yes.