How to expose on-premise SAP B1 service layer with signed SSL cert

[pal3kuno]

Hello,

We have SAP B1 on-premise and I would like expose the service layer externally with a valid domain and SSL. how to do it? Thank you

[EunSeok_Bang · Accepted solution]

Hello @pal3kuno,

Would you please refer to my blog and material? 

https://community.sap.com/t5/enterprise-resource-planning-blogs-by-sap/best-practices-for-technical-...

For the step-by-step guide on how to implement this configuration, access the e-learning course on the SAP PartnerEdge portal (S-user required) :

• Presentation
• Step-by-step video

Regards
EunSeok

[pal3kuno · Accepted solution]

Hi EunSeok, Thank you for your response. Let me check it out.

[pal3kuno · Accepted solution]

Hi EunSeok, I have watched your video tutorial and I was a bit confused on getting the public IP address. our SAP B1 is on a local network, how to get the public IP? thank you

[EunSeok_Bang · Accepted solution]

Hi @pal3kuno, the basic idea is having one small proxy server with public IP address instead of exposing the B1 server itself to the public network to keep the security best practice. I assume you are in the OP environment. then have one additional small server for NGIX as reverse proxy and put it in the DMZ and assign public IP address.

[pal3kuno · Accepted solution]

Hi EunSeok, I have setup the ubuntu as my proxy server (IP: 192.168.1.1). How to get the public IP address? are you referring to this site https://whatismyipaddress.com? is that how to get the public IP? Thank you

[EunSeok_Bang · Accepted solution]

it's a public IP, however you need to work with the customer's IT administrator to have a fixed public IP address for your server.

[pal3kuno · Accepted solution]

The process are the same for SAP B1 on SQL, right?

[EunSeok_Bang · Accepted solution]

yes it is.

[pal3kuno · Accepted solution]

Hi EunSeok, I have a question regarding the SSL certificate. I purchased one, but the file extensions are .crt and .pem. Are these the same with your example .cer and .key? Thank you

[EunSeok_Bang · Accepted solution]

The .cer and .key formats are required. there are several options to covert them but I used the online tool provided by the CA. I assume your CA also provide it.

[pal3kuno · Accepted solution]

Hi EunSeok, Thank you for your response, one more question. Since the nginx proxy server is on my local network, do I need to port forward the port 80 and 443 on my router? Thank you

[EunSeok_Bang · Accepted solution]

you can configure and use any ports for the external urls. in my example in the slide I used the port 443 for the Web client service and 8443 for the rest of the services. refer to the page 38 and 39 in the slide.