SSL in JAVA NetWeaver.

[shalabhkumar]

Overview of SSL JAVA.

In SAP Java (SAP NetWeaver AS Java / SAP BTP Java applications), SSL (Secure Sockets Layer) refers to the use of SSL/TLS protocols to secure communication between SAP Java systems and other systems, browsers, web services, databases, or SAP components.

Purpose.
This blog describes the steps to configure SSL for the SAP NetWeaver AS Java.

Benefits of SSL for the SAP NetWeaver AS Java .

1. Secure User Authentication.
Encrypts user IDs and passwords during login.
Prevents attackers from capturing credentials over the network.
2. Server Authentication.
Uses digital certificates to verify that users are connecting to the legitimate SAP NetWeaver Java server.
Protects against spoofing and man-in-the-middle attacks.
3. Secure HTTPS Communication.
Enables secure access using HTTPS instead of HTTP.

Prerequisites for Configuring SSL in SAP NetWeaver Java.

1. SAP NetWeaver Java System Installed.
SAP NetWeaver AS Java must be up and running.
Access to the NetWeaver Administrator (NWA) is required.
2. SSL Server Certificate.
A valid server certificate and Intermediate CA certificate  and Root CA certificate is needed.
The certificate can be:
Issued by a trusted Certificate Authority (CA) such as DigiCert, GlobalSign, Sectigo, etc.
3. Trusted CA Certificates.
Root CA and Intermediate CA certificates must be imported.
4. HTTPS Port Configuration.
HTTPS Port must be enabled on the Java server.
The SSL port should be configured and open in the firewall.
5. DNS Name Matching.
The certificate Common Name (CN) or Subject Alternative Name (SAN) must match the server hostname.
Example:
Server URL: https://portal.company.com
Certificate CN: portal.company.com
6. Administrative Access.
You need access to:
NetWeaver Administrator (NWA)
Operating System (if certificate files need to be copied)
Security administration roles
7. Network
https port should be open from system and telnet should work with https port.

Team Requirement
1. Network Team will open https port.
2. Basis Team will do this SSL Configuration.
3. CA Team will sign this Certificate..

How to test SSL in JAVA working fine?
1. Access the Application Using HTTPS
Open a browser and access the Java application using HTTPS:
https://<hostname>:<https_port>

2. Test HTTPS Port Connectivity
1.From the OS level:
telnet <hostname> <HTTPs port>
2.Verify SSL Configuration in NWA
Navigate to:--NWA → Configuration → Security → Certificates and Keys
SSL Server Identity exists.
Certificate is valid.

We can configure SSL in JAVA NetWeaver with two methods.
1. From OS Level sapgenpse command.
2. From NWA Portal Certificates and Key : Key Storage

I will show you both methods.

1 First i will show you from OS Level sapgenpse command.

Step1 
I am going to configure SSL in JAVA.
Open NWA home page and navigate to Configuration--SSL

You will can below message showing. SSL port "54101": Not active

Step 2

Now Start the SSL Activity and make sure you take Complete Backup of System.
Take Backup of sec Dir.   /usr/sap/SID/J00

Step 3

Now go to /usr/sap/Q1A/J00/sec path and see structure of this path. Only 3 files is there.

Step 4

Now execute below commands
csh
setenv SECUDIR
setenv SECUDIR /usr/sap/SID/J00/sec

Step 5

Now Generate certificate with command below.
sapgenpse get_pse -p cert.pse -a sha256WithRsaEncryption -s 2048 -r csr.txt -k GN-dNSName:hostname with FQDN -k GN-dNSName:hostname with FQDN "CN=hostname with FQDN, OU=, O=, L=, C="

it will ask you to set the PIN. Remember this PIN because this PIN need to import Certificate later.
Hostname with FQDN
CN Common Name
OU Organizational Unit
O Organization
L Locality (City)
C Country

Step 6

Two file created csr.txt and cert.pse

Step 7

Now open csr.txt with more command.

Step 8

Now copy this Certificate and Sign from CA Authority or from SSO Server.
in my case i have SSO Server so i am signing this CSR from my SSO Server. You can Sign it from your Authorized CA. If you have SSO server below is steps for sign the certificate. 

Step 9

Open SSO Server.

Step 9.1

Paste here CSR certificate and Show Certificate Request. 

Step 9.2

Step 9.3

Then Click in Sign Certificate.

Step 9.4

Now we have sign certificates.

Step 10.

Now create one file SID.p7b  in /usr/sap/SID/J00/sec path with touch command SID.p7b

Step 11

Now open in vi mode and paste here that Server certificate which we signed from SSO and we need paste here root and intermediate certificate also. If you are signing this certificate from your CA you should have root intermediate  certificate also.
Total 3 Certificates need to paste here.   
First import Server Certificate 2nd Intermediate CA certificate 3rd Root CA certificate.

And save it from :wq! command

Step 12

Now Import the signed certificate.
sapgenpse import_own_cert -p cert.pse -c SID.p7b
It will prompt you to enter a PIN. Please provide the same PIN that you used while generating the certificate.

Step 13

Now run this command ---->  mv SAPSSLS.pse SAPSSLS.pse_orig

Step 14

Now Copy cert.pse to SAPSSLS.pse.-----> cp -r cert.pse SAPSSLS.pse

Step 15

Now run this command ---> sapgenpse seclogin -p /usr/sap/SID/J00/sec/SAPSSLS.pse -O sidadm
It will ask you Pin.  You need provide same Pin here which you given earlier.

Step 16

For PSE Status run this ---> sapgenpse get_my_name SAPSSLS.pse

Step 17

Now Generate private key pair & certificate:
sapgenpse export_p12 -p SAPSSLS.pse Q1A_SSL_PrivKey

Step 18

Now run this -> sapgenpse export_own_cert -p SAPSSLS.pse -o Q1A_SSL_cert.cert

Step 19

Take the Backup of Server Profile.
Now open DEFAULT.PFL Profile and change this parameter value service/protectedwebmethods = SDEFAULT –GetAccessPointList 

Step 20

Open the Instance Profile and make changes your parameter like below value.
icm/server_port_1 = PROT=HTTPS, PORT=50001, SSLCONFIG=ssl_config_1
icm/ssl_config_1 = VCLIENT=0, CRED=/usr/sap/Q1A/J00/sec/SAPSSLS.pse

Step 21

Take Service restart---> sapcontrol –nr 00 –function RestartService

Step 22

Now Copy this Q1A_SSL_PrivKey.p12 file and Q1A_SSL_cert.cer from OS to Local Desktop for import the certificate.

Import private key pairs to ICM via certificate & keys
it will ask to you Pin. You need to provide same Pin here.
Key imported here.

You can see Privkey imported.

Step 23

Step 24

Now Take restart of System.

Step 25

You can monitor JAVA Staring Process.

Step 26

Now Launch NWA with https and 50001 port.
URL access from https and 5001 port.

SSL is completed with 1 Method.-------------------------------------------------------------------------------------------------------------------------------------

Now i will show Second Method.

Next, I will demonstrate the second method available on the NWA page under Certificates and Keys.

Step 1

Open NWA
Configuration
Certificates and Keys
ICM_SSL_instance ID. This instance you can check from instance Profile.
Click on Create tab.

Step 2

Step 3

Step 4

You need to fill below information 
Country Name
State Name
Organization name
Organization Unit
Common Name

Step 5

Now you need to give Email and DNS name.  
DNS name your FQDN need to provide.

Step 6

Hashing Algorithm Signature SHA-256

Click next it will give you summary and Finish.
You can see EPD coming now we are going to generate CSR request

Step 7

Download this file open in note pad and Send to CA for Sign.

Step 8

Once you received the Sign Certificate import from NWA. 
Configuration
Certificates and Keys
Select your ICM_SSL_Instance-ID
Import CSR response.

Step 8.1

Step 9

You need to change same parameter Value in DEFAULT and Instance Profile in this method also.
This will change in Instance Profile.
icm/server_port_2 = PROT=HTTPS, PORT=52001, SSLCONFIG=ssl_config_1
icm/ssl_config_1 = VCLIENT=0, CRED=/usr/sap/EPD/J20/sec/SAPSSLS.pse

Step 10

Take Application Restart.

 

Step 11.

Now launch the URL with https://FQDN:port/nwa.   
It will open with https port.  
SSL is completed with 2 method.

*************************************************************************************************************************************************

************************Errors Encountered and Solutions Implemented During SSL Configuration*****************************

During the SSL configuration, I encountered some error messages. Let me share the solutions that helped resolve them.

Error 1
When i go to NWA--->Configuration--->SSL an found that SSL status is RED and Port not active.​<strong><br /><li-image width="999" height="999" alt="shalabhkumar_2-1788432688423.png" align="inline" id="455186iE609DEBBAF5970D4" size="large" resized="false" sourcetype="new"></li-image></strong>

 

Solution-->2510099 - SSL Port XXXXX Not Active - message on NWA even though SSL works
I added below parameter  in instance profile and restart all instance and check again SSL Status is Green.
jstartup/service_acl = *

Error 2
I received the following error message during SSL certificate implementation.<li-image width="999" height="999" alt="shalabhkumar_11-1788415818150.png" align="inline" id="455046iD65E5715747235CC" size="large" resized="false" sourcetype="new"><li-code lang="abap">Solution --> I found below two notes and its is saying update your SPS till 26. In my case my SPS is 25 and this issue is fixed with SPS 26. So i am updating whole SPS from 25 to 36.
3243600 - Importing PKCS#12 certificate in NWA fails - ID21108: Invalid P
3382449 - Java.security.NoSuchAlgorithmException: Algorithm HmacPBESHA256 not available<li-code lang="abap">Error 3
I received the following error message during SSL certificate implementation from NWA.

Solution--> 1745538 - "Error: -> Certificate chain incomplete, no certificate found for issuer: " during import of CSR response
First import Server Certificate 2nd Intermediate CA certificate 3rd Root CA certificate and take Restart all instance.<li-code lang="abap">Error 4
Again i was facing issue while importing the Certificates getting below message.

Solution---> Solution 2338325 - No certificate matches the given private key
I Generate a new CSR Request and send to CA for Signing after Sign import again and my issue fixed.<li-code lang="abap">Error 5
In SSL Configuration below error messaging coming.

Solution
Solution 2291537 - use only one private key per keystore view<li-code lang="abap">We have two Private Key.  As per note need to delete one Private Key.  So i am deleting ssl-credentials  PRIVATE key.
Restart the server after deleted private key and this issue will be fixed.

 

SSL configuration in SAP Java NetWeaver ensures secure communication between clients, web browsers, SAP systems, and external applications by encrypting data transmitted over the network.

Conclusion:
Java SSL in SAP NetWeaver is implemented to secure all network communications through encryption and certificate-based trust, protecting enterprise applications from eavesdropping, tampering, and impersonation attacks.