SAP Enable Now/Companion Server Certificate Renewal from Basis End #ATR

[AJAYTR]

#ATR (21)

Informative Note:

• Created this blog to provide information on how to renew/apply SAP Enable Now Certificate from Basis End.
• SAP Enable now (Author/Consumption) Edition / Companion will be used/connected usually in S/4 HANA Systems where business users use and create own contents/Edit SAP Standard Contents.

• If SAP Enable now Manager/WorkArea Connected to SAP System, Both SAP System and Enable now should have Valid Certificate to secure HTTPS SSL Say Fiori Launchpad.
• If SAP Enable now certificate expired, it will show “Not Secure – SSL” link even though SAP System certificate valid/Ignore to connect Enable Now WorkArea.
• It will also lead to multiple unnecessary logons/improper updates/SSL Connection issues if SAP System runs with SSL.

• In SAP System, it will be SAPSSL*.PSE file generation. We will use import command and create/generate PSE files with our Trusted CA Certificates itself which created and downloaded from SAP MMC.
• For Enable Now, we can directly use PFX/P12 Certificate itself for SSL Connection.

Usual Procedure:

• Using Keytool, we can able to create keystore (JKS) with own private key/alias which asks to fill information while creating keystore.
• You can also convert JKS to P12 (Optional)
• Once Java keystore private key created, we can generate Certificate Signing request for that private key and get CA response (Certificate root, server, intermediate signed by CA)
• Once CA approved certificate received, we can renew/apply/overwrite certificate to our Keystore.
• You can ignore this blog if you are seeking usual procedure - CSR request method.
• Usually, it won’t be allowed in most of the Organizations to approve own certificate.
• Valid Server Certificate (Matching CN as Server Name – PCKS12 – PFX/P12) should be issued by Security Team/Generate manually from SAP MMC.
• We need to use the same and make Enable now to pick Keystore certificate for SSL like SAP.

SAP MMC Certificate Renewal Steps:

• Request a new certificate in SAP MMC and download PFX File.
• Unlike SAP, we don’t need separate server, root and intermediate certificate itself if you have PFX file.
• Tomcat supports PFX/P12 Extensions. We can use our PFX File directly. SAP Enable Now will pick the same for SSL Connections.

• Downloaded as “EnableNowCertificatePFX.pfx”.

With Private Key and Certificates:

• In case if you have received Signed Server Certificate and Private Key separately from Security team (Base-64 Encoded Format X.509 CER – Readable Format/PEM), You can use OpenSSL and create P12/PFX file by using it.

• OpenSSL will be open-source software. You can surf in web and download.
• Create Single text file by placing certificates in order Server -> Issuer -> Root Certificates.

• Command: openssl pkcs12 -export -in Certificate.txt -inkey PrivateKeyFile.key -name EnableNowCertificate -out EnableNowCert.p12
• It will generate an EnableNowCert.P12 Keystore file which will have Private entry and Certificates under alias EnableNowCertificate.

• Check Keystore certificate list via Java Keytool.
• You can use any Java versions - JRE/JDK/SAPJVM since we are going to check certificate list only.

• Private Key with Certificates exist in Keystore as expected.

• We can use our created P12 Keystore for Tomcat – Enable Now SSL Connection.

Tomcat: Making PFX/P12 Keystore file for SAP Enable Now SSL Connection

• You can paste our downloaded PFX/P12 file in any path whichever tomcat access available.
• Mine -> C:\Program Files\Java\jre1.8.0_311\bin

• Now, Edit server file and make tomcat to choose our created keystore for certificate authentication. It will be used automatically for Enable Now as well.
• No need to use any predefined protocols APJ APR.
• Simply added below entries after HTTP and it will work fine. Make sure you are giving right keystore file and password.
• C:\Program Files\Apache Software Foundation\Tomcat 8.5\conf/server.xml
• I have crosschecked with both certificates.

*Restart Tomcat to take effect*

 

Check SSL Connection – SAP Enable Now:

•  SSL Connection fine now.

 

• With EnableNowCert.p12 -> July 17, 2024 – August 16, 2025

 

• With EnableNowCertificatePFX.pfx -> July 19, 2024 – August 18, 2025

 

Check SAP System Fiori Launchpad:

• Connecting to SAP Enable Now

• Connection is secure now.

• We have successfully renewed SAP Enable Now Certificate.

WANNA KNOW MORE ABOUT SSL CONFIGURATION ON ABAP AND HANA?

PLEASE REFER BELOW BLOG

MANUAL SAP SSL CONFIGURATION FOR S/4 HANA (ABAP AND HANA) SYSTEM from OS_LEVEL #ATR

Thanks for Visiting!