B2B Adapters - Updating to JCE Unlimited Strength Jurisdiction Policy

[Former Member]

The default JCE policy files supplied by SAP JVM contains only limited strength. So it will not support if the keys are generated with the size more than 128 bits. But the newly shipped components like PGP, OFTP and AS2 requires key sizes which are greater than 128
bits for better security. Especially PGP modules will not support keys with the size less than 1024 bits. So in order to support the same, the default limited JCE policies should be overridden with the unlimited strength. The following steps will be describes the steps to be followed in detail.

Step 1:

SAP ships only limited strength files. You have to download the unlimited stregnth files from the Java provider (Sun/Oracle). These policies depend on the JVM versions. So download the corresponding policy files based on the JVM version(7.11 uses JVM 5, 7.30 &
7.31 uses JVM 6)

http://www.oracle.com/technetwork/java/javasebusiness/downloads/java-archive-downloads-java-plat-419...

You can download the files after accepting the license agreement.

Step 2:

Extract the following files from downloaded zip file.

Step 3:

Login to the Application Server and replace the above mentioned files in the following locations.

1. <root>\usr\sap\<SID>\J<XX>\exe\sapjvm_6\jre\lib\security 
2. <root>\usr\sap\<SID>\J<XX>\j2ee\JSPM\sapjvm\jre\lib\security
3. <root>\usr\sap\<SID>\SYS\exe\jvm\NTAMD64\sapjvm_<Version>.<Patch>\sapjvm_<Version>\jre\lib\security

<SID> - System ID

J<XX> - Java Only Instance. If it is Dual Stack, it will D<XX> or DVEBMGS<XX>

<Version> - JVM Version. It could 5 or 6

<Patch> - JVM Patch

Example :

D:\usr\sap\B2B\J00\exe\sapjvm_6\jre\lib\security

D:\usr\sap\B2B\J00\j2ee\JSPM\sapjvm\jre\lib\security

D:\usr\sap\B2B\SYS\exe\jvm\NTAMD64\sapjvm_6.1.031\sapjvm_6\jre\lib\security

The above mentioned paths are from PI 7.31 which installed on windows OS. If multiple JVM patch is installed (like 6.1.030, 6.1.031 etc...), the files from all the patch (or) recent patch should be replaced. For other operating systems, the relevant paths can be substituted.

Step 4:

Just restart the engine for the JVM to be updated with the new policies.

In the upcoming posts, I will be writing about the possible issues might occur if JCE unlimited strength is not installed.