Communication encryption is a key feature to secure data in transit. Usage of encrypted communication channels can prevent attackers to intercept traffic on network level. SAP HANA supports encrypted communication for all client-server (external) communication and HANA internal communication.
SAP HANA recommends using encrypted communication channels where possible.
The aim of this document is to describe one way of configuring secure communication (TLS/SSL) in typical installation scenarios. The initial scenario described is an SAP HANA system installed on a single host with incoming connections from SQLDBC and HTTP clients for database and administrative access. TLS/SSL configuration is explained for following incoming connections to HANA:
- Database clients via the SQL interface (port 3xx13/3xx15), e.g. SAP HANA studio, SAP HANA cockpit
- SAP HANA cockpit/studio via SAP start service (sapstartsrv) (port 5xx13/5xx14)
- SAP HANA database lifecycle manager via SAP Host Agent (port 1128/1129)
- Web applications via XS advanced application server (ports used depend on XSA routing mode)
- XS advanced server via the SQL interface (port 3xx13/3xx15)
- Web applications via the XS classic server (port 43xx)
Detailed instructions can be found in the document "
How to Configure TLS/SSL in SAP HANA 2.0"
