Transport Layer Security on the AS ABAP
Transport Layer Security on the AS ABAP
Content
Transport Layer Security on SAP NetWeaver AS for ABAP
Configuring SAP NetWeaver AS for ABAP to Support TLS
Setting the Profile Parameters for Using SSL
Creating an SSL Server PSE
Generating Certificate Requests for the SSL Server PSEs
Sending the Certificate Requests to a CA
Importing the Certificate Request Response
Maintaining the SSL Server PSE's Certificate List
Creating the Standard SSL Client PSE
Creating the Anonymous SSL Client PSE
Creating Individual SSL Client PSEs
Specifying that a Connection Should Use SSL
Maintaining the User Mapping for Incoming Connections that Use Authentication
Testing the SSL Configuration
Making Sure the SSL Port is Set up Correctly
Testing the Connection for SSL Server Authentication
Testing the Connection for SSL Client Authentication
Secure Network Communications (SNC)
SNC in the SAP System Architecture
Terminology
Integration of SNC and an External Security Product in SAP Systems
External Security Products
Communication Paths that Support SNC
General Comments Pertaining to the SNC Configuration
Recommendations
Configuring SNC on AS ABAP
Prerequisites for Using SNC
Profile Parameter Settings on AS ABAP
snc/enable
snc/gssapi_lib
snc/identity/as
snc/data_protection/max
snc/data_protection/min
snc/data_protection/use
snc/r3int_rfc_secure
snc/r3int_rfc_qop
snc/accept_insecure_cpic
snc/accept_insecure_gui
snc/accept_insecure_r3int_rfc
snc/accept_insecure_rfc
snc/permit_insecure_start
snc/force_login_screen
Sample Profile Parameter Settings for SNC
Profile Parameter Settings on the Gateway
Customizing Activities on AS ABAP for Using SNC
Upgrade from 3.0/3.1
Access Control Lists (ACL)
Network Communication Partners
Maintaining SNC Information of Users on AS ABAP
Maintaining SNC Information for Dialog Users
Maintaining SNC Information for Non-Dialog Users
Suppressing the Logon Screen
Configuring the Communication Partners to Use SNC
Configuring SNC: SAP GUI àAS ABAP
Configuring SNC: SAP GUI when Using Direct Start
Configuring SNC: SAP GUI when Using SAP Logon
Configuring SNC: SAP GUI When Using SAP Shortcuts
Processing the Logon
Configuring SNC: External Programs -> AS ABAP
Configuring SNC: External Programs to AS ABAP Using RFC
Configuring SNC: External Programs → AS ABAP Using CPIC
Configuring SNC: Using RFC from AS ABAP
Maintaining RFC Destinations and their SNC Options Using Transaction SM59
RFC: AS ABAP àAS ABAP
RFC: Internal Destinations
RFC: Logical Destinations
RFC: TCP/IP Connection - Start an External Program on an Application Server
RFC: TCP/IP Connection - Start an External Program on an Explicit Host
RFC: TCP/IP Connection - Start an External Program over SAPGUI
RFC: TCP/IP Connection - Registered Program
Remote Logon Using Transaction SM51
Special Destinations and RFC Groups
Configuring SNC: Using CPIC from AS ABAP
Maintaining CPIC Destinations and Their SNC Options Using Transaction SM54
CPIC: AS ABAP → AS ABAP
CPIC: Start an External Program over a Gateway
CPIC: Registered Program
Configuring SNC: Printing
Configuring SNC: SAProuter → SAProuter
C Program Interfaces
Interfaces to External CPIC Programs
Interfaces to External RFC Programs
Appendixes
Sample SNC Scenario
SNC-Related Tables on AS ABAP
Maintenance Utilities on AS ABAP
SNC Messages on AS ABAP
Using the SAP Cryptographic Library for SNC
Scenarios
SNC Scenario 1: Using a Single Key Pair for ALL Components
SNC Scenario 2: Using Individual Key Pairs for Components
Configuring the Use of the SAP Cryptographic Library for SNC
The SAP Cryptographic Library Installation Package
Recommended Locations of Files
Configuring SNC for Using the SAP Cryptographic Library on SAP NetWeaver Application Server for ABAP
Creating the SNC PSE
Importing the SNC PSE
Exporting the SNC PSE
Exchanging Public-Key Certificates Starting on the AS ABAP
Exporting the AS ABAP's Public-Key Certificate
Importing Public-Key Certificates on the AS ABAP
Connection-Specific Configurations
Making the Access Control List Entries on the Application Server
Setting the SNC Profile Parameters
Configuring SNC for Using the SAPCRYPTOLIB Using SAPGENPSE
Installing the SAP Cryptographic Library on an Arbitrary Server
Creating a PSE for the Server Using SAPGENPSE
Creating the Server's Credentials Using SAPGENPSE
Checking the Application Server's User (Windows)
Exchanging Public-Key Certificates
Exporting the Server's Certificate Using SAPGENPSE
Maintaining the Server's Certificate List Using SAPGENPSE
Connection-Specific Configurations
Additional Functions
Deleting the Server's Credentials
Changing the PIN
Renewing the Server's Certificate
Exporting a PKCS#12 File
Importing a PKCS#12 File
The Configuration Tool's Generic Command Line Options
Using SNC Client Encryption for Password Logon
Preparing SAP NetWeaver AS for ABAP
Installing SNC Client Encryption
Configuring SAP GUI for Windows
How SNC Client Encryption Works
Additional Information
SNC Names, SSO, and User Mapping
Performing an Unattended Installation
Confirming SNC Connections
Troubleshooting SNC Client Encryption
Enabling Traces for SNC Client Encryption
Encrypting Internal Server Communication of SAP NetWeaver AS for ABAP