Replacing Default SAP Mobile Platform Server Certificate

Use

The self-signed certificate smp_crt is created during installation and contains the fully qualified domain name of the system as its CN. By default, the same certificate is configured for all secure connections in SAP Mobile Platform Server. You must replace this default certificate with a production-ready certificate after you install SAP Mobile Platform. For shared certificates, SAP recommends that you maintain the existing certificate alias when importing the new certificates.

Procedure

Obtain a Signed SSL Server Certificate for SAP Mobile Platform Server

Go to the <SMP_HOME>\sapjvm_7\bin folder.
Generate a new key pair with the command:

keytool -genkey -dname cn=<common name>,o=<organization>,c=<country> -alias smp_crt -keyalg RSA -keystore smp_keystore.jks

Note
The common name (CN) is the fully-qualified domain name for your server, consisting of the hostname and the domain name.
Generate a certificate signing request (CSR) with the command:

keytool -certreq -keyalg RSA -alias smp_crt -file smp.csr -keystore smp_keystore.jks.
Send the contents of the certificate request to your CA. The procedure depends on the CA that you use.
Copy the response (including ---BEGIN and END---) into smp.rsp.
Import the signed certificate into the keystore with the command:

keytool -importcert -alias smp_crt -file smp.rsp -keystore smp_keystore.jks.

Note
When the file being imported contains a certificate signing response, keytool checks if the owner field of the existing certificate matches what is being imported, and replaces the certificate if they match. (The issuer field will have changed to the CA.)

More Information

Setting Up Communication Channels

SAP Mobile Platform Server: Setup of Communication