Import a PSE or manipulate the validity date

[Former Member]

Hello everybody,

we want to try a scenario, in which the public key certificate gets invalid.

For this reason we want to have a public key certificate which is only valid for one day. When creating or replacing the application PSE the "valid to"-date (self-signed certificate) everytime is in year 2038.

Is it possible to manipulate this date?

Or can I import a PSE created with another tool (for example the java keytool)? I tryed to import a pkcs#12-file to an application PSE which we want to use with the SSF but I got the error message "PSE could not be opened" (german: "PSE konnte nicht geöffnet werden").

Is it possible to import PSEs which are stored in pkcs#12-format in the file system? Which format is used by the SAP system when exporting a PSE?

Regards

Georg

[Former Member]

Hello everybody,

we want to try a scenario, in which the public key certificate gets invalid.

For this reason we want to have a public key certificate which is only valid for one day. When creating or replacing the application PSE the "valid to"-date (self-signed certificate) everytime is in year 2038.

Is it possible to manipulate this date?

Or can I import a PSE created with another tool (for example the java keytool)? I tryed to import a pkcs#12-file to an application PSE which we want to use with the SSF but I got the error message "PSE could not be opened" (german: "PSE konnte nicht geöffnet werden").

Is it possible to import PSEs which are stored in pkcs#12-format in the file system? Which format is used by the SAP system when exporting a PSE?

Regards

Georg

[Former Member]

Hello Georg,

you cannot manipulate the "valid to" date during the creation of the PSE.

This date is adjusted during the certification process by the CA (normally they issue certificates valid for 1 year).

You can create a PSE from a pkcs#12 file by using the "sapgenpse" tool which is delivered with the sapcryptolib. The option "import_p12" is the one you need.

For more information just type "sapgenpse import_p12 -h"

--> the PSE you're creating with sapgenpse you can afterwards import in strust with "PSE -> Import"

Regards, Uwe

[Former Member]

Hello Uwe,

thanks for your help. I tried this and I' ve been succesful.

Regards

Georg

[Wolfgang_Janzen]

See also

[Former Member]

Hello Wolfgang,

thanks for your fast reply. The description of the referenced post helped me to import the *.pse-file in the transaction strust.

Regards

Georg

[Former Member]

I think it maybe possible to make a self signed certificate within the 6.40 java engine or if you have a Microsoft server "laying around" you could install certificate services and be your own CA to make the cert.

[Former Member]

Hello David,

I am working on a SAP WEB AS 7.0. The certificates created with STRUST are self signed.

I have created a certificate request and we are now trying to sign it with a Microsoft PKI-Tool. We will see if it's easy to read the answer into STRUST or if I will have to convert the answer again into a proprietary SAP format.

Regards

Georg

[Wolfgang_Janzen]

You should be able to import the (standardized) certificate response (of your CA) using STRUST. But you might have to concatenate all certificates (Base64 encoded) which are required by the chain verifier (-> up to the root CA certificate) in that response; otherwise the import request might be rejected.

The only time you need to use the command-line tool sapgenpse is when you want to perform an PKCS#12 export / import (to / from the proprietary PSE format).

Regards, Wolfgang

[Former Member]

Hello Wolfgang,

thanks for your reply.

I have tried this with the "SSL Test Server Certificate" (https://websmp210.sap-ag.de/SSLTEST) and this worked fine with the PSE I have converted from the pkcs#12-file.

Regards

Georg