Community
Technology Blog Posts by SAP
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Introduction

This blog documents the steps required to configure SSL/TLS encryption between the SAP Java stack and an SAP HANA database, using a certificate signed by an external Certificate Authority (CA). This is a common requirement in enterprise migrations and security hardening projects where the default SAP-generated certificates are replaced with organisation-specific ones.

Unlike the ABAP stack — which uses SAP CommonCryptoLib and PSE files — the Java stack manages its trusted certificates via the Java cacerts keystore, and the encrypted connection is enabled through the JDBC connection string in the Java Secure Store. This guide covers both aspects.

This guide assumes a Linux-based SAP Java stack (e.g. SAP NetWeaver Java or dual-stack system) with an SAP JVM (sapjvm) installation.

Prerequisites

  • Certificate (.pfx format) signed by an external CA, plus the corresponding root certificate
  • OS-level access to the Java application server
  • Access to the SAP Java Configuration Tool (via VNC or equivalent)
  • All cacerts files backed up before making any changes

Overview

The procedure involves two main areas:

  1. Java keystore (cacerts) updates — the certificates are imported into the SAP JVM keystore on the Java application server. The SAP JVM maintains two separate cacerts files across different installation paths — both must be updated to ensure certificates are trusted across all JVM components.
  2. JDBC connection string update — the connection string in the Java Secure Store is updated to enable encryption and certificate validation for the Java-to-HANA connection.

Step 1 — Convert the Certificate from .pfx to .cer

The certificate is provided in .pfx format. The Java keystore import tool (keytool) requires a .cer format. The .pfx can be converted using either of the following methods:

Option A — OpenSSL (recommended, at OS level):

openssl pkcs12 -in <certificate_name>.pfx -clcerts -nokeys -out <certificate_name>.cer

This extracts only the certificate (not the private key) and can be run directly on the Linux server. See SAP Note 2755238 for further reference on certificate format conversions.

Option B — Transaction STRUST (on an available ABAP system):

Upload the .pfx file in transaction STRUST and export it as a .cer file.

You now have <certificate_name>.cer ready for import into the Java keystore.

Step 2 — Upload Certificates to the Java Application Server

Upload both <certificate_name>.cer and <root_cert_name>.cer (and any intermediate certificates) to the Java sec directory on one of the application servers:

/usr/sap/<SID>/J<instance_nr>/sec/

Step 3 — Import Certificates into the First Java Keystore Location

Note: Throughout Steps 3 and 4, replace <certificate_name>, <root_cert_name>, <cert_alias> and <root_cert_alias> with names appropriate to your system. Each alias must be unique within the keystore.

Location A:

/usr/sap/<SID>/SYS/exe/jvm/<platform>/<sapjvm_version>/jre/lib/security/

Adapt <platform> (e.g. linuxx86_64) and <sapjvm_version> to match your specific OS architecture and SAP JVM installation. Confirm the exact path on your system before proceeding. This is where all Java certificates are stored.

Navigate to Location A and back up the cacerts file before making any changes:

cp cacerts cacerts.bak

Import the certificate:

keytool -importcert \
  -file /usr/sap/<SID>/J<instance_nr>/sec/<certificate_name>.cer \
  -keystore /usr/sap/<SID>/SYS/exe/jvm/<platform>/<sapjvm_version>/jre/lib/security/cacerts \
  -alias <cert_alias>
  • Enter the keystore password when prompted: <password>
  • Type yes when asked to trust the certificate

Import the root certificate:

keytool -importcert \
  -file /usr/sap/<SID>/J<instance_nr>/sec/<root_cert_name>.cer \
  -keystore /usr/sap/<SID>/SYS/exe/jvm/<platform>/<sapjvm_version>/jre/lib/security/cacerts \
  -alias <root_cert_alias>

Validate both certificates were imported successfully:

keytool -list -v -keystore cacerts -storepass <password> | grep "Alias name:" | sort

Confirm that <cert_alias> and <root_cert_alias> appear in the output.

Step 4 — Import Certificates into the Second Java Keystore Location

Location B:

/usr/sap/<SID>/J<instance_nr>/exe/<sapjvm_version>/jre/lib/security/

Adapt <sapjvm_version> to match your SAP JVM installation.

Navigate to Location B and back up the cacerts file:

cp cacerts cacerts.bak

Import the certificate:

keytool -importcert \
  -file /usr/sap/<SID>/J<instance_nr>/sec/<certificate_name>.cer \
  -keystore /usr/sap/<SID>/J<instance_nr>/exe/<sapjvm_version>/jre/lib/security/cacerts \
  -alias <cert_alias>

Import the root certificate:

keytool -importcert \
  -file /usr/sap/<SID>/J<instance_nr>/sec/<root_cert_name>.cer \
  -keystore /usr/sap/<SID>/J<instance_nr>/exe/<sapjvm_version>/jre/lib/security/cacerts \
  -alias <root_cert_alias>

Validate:

keytool -list -v -keystore cacerts -storepass <password> | grep "Alias name:" | sort

Step 5 — Update the JDBC Connection String

The JDBC connection string in the Java Secure Store must be updated to enable encryption.

  • Open the SAP Java Configuration Tool using VNC
  • Navigate to the Secure Store tab
  • Locate the database connection string and update it to the following format:
jdbc:sap://<hana_host>:<port>/?databaseName=<SID>&encrypt=true&hostnameincertificate=<hana_hostname>&validatecertificate=true&transactionalLobs=false

Key values to adapt:

  • <hana_host> — HANA database hostname

  • <port> — HANA SQL port (e.g. 30213 for tenant DB instance 13)

  • <SID> — HANA database system/tenant name

  • <hana_hostname> — fully qualified hostname as it appears in the certificate's CN/SAN field

  • Save and close the configuration tool

Initial validation: Re-open the configuration tool. If it opens successfully without errors, the connection string is syntactically valid and you can proceed. If not, review the connection string parameters before continuing.

Step 6 — Restart the Java Application and Validate

Restart the Java application stack.

Once the Java stack is up, run the following SQL statement against the Java schema. This can be executed via SAP HANA Studio or hdbsql at OS level — replace <SCHEMA> with the correct Java schema name:

SELECT IS_ENCRYPTED, SSL_VERSION, CLIENT_HOST
FROM SYS.M_CONNECTIONS
WHERE USER_NAME = '<SCHEMA>'
AND IS_ENCRYPTED = 'TRUE';

If the sessions returned by this query show TRUE in the IS_ENCRYPTED column, SSL encryption between the SAP Java stack and SAP HANA has been successfully configured.

Summary

At this point, SSL encryption between the SAP Java stack and SAP HANA is active. The certificates have been imported into both SAP JVM keystore locations, and the JDBC connection string has been updated to enforce encryption and certificate validation.

Tip: If you are also configuring SSL for the ABAP stack on the same system, refer to the companion blog: Configuring SSL Encryption Between SAP ABAP Application Servers and SAP HANA.

This guide was produced by the IT Planning and Software Logistics team, SAP Ireland, based on field experience across enterprise SAP migration projects.

Comment
Labels in this area