Protecting the Application Server's Keys
Each AS ABAP server owns a public and private key pair to use for digitally signing. The private key is contained in the system PSE (personal security environment) (filename SAPSYS.pse; in Release 4.5, filename SAPSECU.pse), which is located in the subdirectory sec of the directory specified by the profile parameter DIR-INSTANCE. Only the user running the application server process (for example, <sid>adm) is allowed to access the files in the sec directory.
It is very important to protect this file from being read or copied by unauthorized access! An attacker who manages to copy this file has access to the application server's private key and can proceed to use it to produce digital signatures that belong to the application server.
If you have reasons to believe that the application server's private key has been compromised, you should create a back-up or the system PSE and delete it using the trust manager (transaction STRUST). During the next start-up, the application server will generate a new PSE with a new key pair.
If any other application (for example, the archive using the SAP ArchiveLink Content Server HTTP interface 4.5) is using the application server's public key, and you replace it with a new one, then you have to publish the new application server's public key to that application. For details, refer to the application's documentation.
The public-key certificate that corresponds to the server's generated key pair is a self-signed (signed with the application server's private key) public-key certificate. As an alternative, you can use certificates that have been signed by a Certification Authority (CA). To verify the certificates, note the following:
- Self-Signed Certificates
If you use self-signed certificates (for example, the application server signs its own certificate, as with archive requests using the SAP ArchiveLink Content Server HTTP interface 4.5), then the receiver of the certificate should explicitly validate it before accepting it for the first time.
- CA-Signed Certificates
If you use certificates that have been signed by a CA and the receiver of the certificates trusts the issuing CA, then the system can automatically verify the certificate. The automated verification process depends on the external security product that you use and can also require many preconditions. For more information, see the documentation provided by the product vendor.