Question Re: How can SAP ECC/S/4HANA on‑prem automate SSL/TLS cert... in Technology Q&A

How can SAP ECC/S/4HANA on‑prem automate SSL/TLS certificate renewal as validity drops to 47 days?

SampathReddy — Thu, 23 Apr 2026 07:42:31 GMT

SSL/TLS certificate lifetimes are being reduced globally (398 days today → 200 days in 2026 → 100 days in 2027 → 47 days in 2029). Source: https://www.sectigo.com/47-day-ssl-guide

For SAP ECC and S/4HANA on‑prem customers, renewing and uploading certificates manually every few weeks will not be practical. I’m looking for SAP‑supported ways to automate certificate lifecycle for on‑prem systems.

SAP Single Sign-On 3.0, SAP Secure Login Server (SLS) can automate certificates today, but it goes into maintenance in 2027, and the successor (SAP Secure Login Service for SAP GUI) does not include Certificate Lifecycle Management.
Are there any other SAP‑supported options to automate certificate renewal for on‑prem systems?

Specifically for SAP ECC/S/4HANA on‑prem:
How can customers automate CSR generation, certificate renewal, and deployment into STRUST / SSL Server PSE without manual steps?

Any guidance, best practices, or experience from customers who have automated this would be very helpful. Thank you!

Also created a customer influence ticket for the same: https://influence.sap.com/sap/ino/#/idea/369565

Re: How can SAP ECC/S/4HANA on‑prem automate SSL/TLS cert...

Vanderlei_Gomes — Thu, 19 Mar 2026 06:20:33 GMT

In a recent discussion with SAP about this topic, I was told SAP is working on a product called CES - Certificate Exchange Service, which runs in BTP and is currently planned to go live in Q4/2026. Official information was not yet shared to my knowledge.

Re: How can SAP ECC/S/4HANA on‑prem automate SSL/TLS cert...

SampathReddy — Thu, 19 Mar 2026 11:00:13 GMT

Hello Vanderlei. That's great information. Do we have a similar product or tool for S/4HANA on‑premise customers who don’t use BTP?

Re: How can SAP ECC/S/4HANA on‑prem automate SSL/TLS cert...

Vanderlei_Gomes — Thu, 09 Apr 2026 05:52:02 GMT

Hum hard question from my understanding, you either stick to Secure Login Server which the Maintenance will expire soon or you use the successor in BTP. This is my understanding from SAP strategy. Of course other companies might offer similar solution as well.