Network and Transport Layer Security

Key Storage and Maintenance

Establishing Trust

SSL Scenario 1: Establishing Trust for Server-Side Authentication

SSL Scenario 2: Establishing Trust for Mutual Authentication

SNC Scenario 1: Using a Single Key Pair for ALL Components

SNC Scenario 2: Using Individual Key Pairs for Components

Transport Layer Security on SAP NetWeaver Application Server ABAP

Configuring the AS ABAP for Supporting SSL

Installing the SAP Cryptographic Library on the AS ABAP

Setting the Profile Parameters for Using SSL

Creating an SSL Server PSE

Generating Certificate Requests for the SSL Server PSEs

Sending the Certificate Requests to a CA

Importing the Certificate Request Response

Maintaining the SSL Server PSE's Certificate List

Creating the Standard SSL Client PSE

Creating the Anonymous SSL Client PSE

Creating Individual SSL Client PSEs

Specifying that a Connection Should Use SSL

Maintaining the User Mapping for Incoming Connections that Use Authentication

Testing the SSL Configuration

Making Sure the SSL Port is Set up Correctly

Testing the Connection for SSL Server Authentication

Testing the Connection for SSL Client Authentication

Secure Network Communications (SNC)

SNC in the SAP System Architecture

Terminology

Integration of SNC and an External Security Product in SAP Systems

External Security Products

Communication Paths that Support SNC

General Comments Pertaining to the SNC Configuration

Recommendations

Configuring SNC on AS ABAP

Prerequisites for Using SNC

Profile Parameter Settings on AS ABAP

snc/enable

snc/gssapi_lib

snc/identity/as

snc/data_protection/max

snc/data_protection/min

snc/data_protection/use

snc/r3int_rfc_secure

snc/r3int_rfc_qop

snc/accept_insecure_cpic

snc/accept_insecure_gui

snc/accept_insecure_r3int_rfc

snc/accept_insecure_rfc

snc/permit_insecure_start

snc/force_login_screen

Sample Profile Parameter Settings for SNC

Profile Parameter Settings on the Gateway

Customizing Activities on AS ABAP for Using SNC

Upgrade from 3.0/3.1

Access Control Lists (ACL)

Network Communication Partners

Transporting the Customizing Configuration

Maintaining SNC Information of Users on AS ABAP

Maintaining SNC Information for Dialog Users

Maintaining SNC Information for Non-Dialog Users

Suppressing the Logon Screen

Configuring the Communication Partners to Use SNC

Configuring SNC: SAP GUI àAS ABAP

Configuring SNC: SAP GUI when Using Direct Start

Configuring SNC: SAP GUI when Using SAP Logon

Configuring SNC: SAP GUI When Using SAP Shortcuts

Processing the Logon

Configuring SNC: External Programs -> AS ABAP

Configuring SNC: External Programs to AS ABAP Using RFC

Configuring SNC: External Programs → AS ABAP Using CPIC

Configuring SNC: Using RFC from AS ABAP

Maintaining RFC Destinations and their SNC Options Using Transaction SM59

RFC: AS ABAP àAS ABAP

RFC: Internal Destinations

RFC: Logical Destinations

RFC: TCP/IP Connection - Start an External Program on an Application Server

RFC: TCP/IP Connection - Start an External Program on an Explicit Host

RFC: TCP/IP Connection - Start an External Program over SAPGUI

RFC: TCP/IP Connection - Registered Program

Remote Logon Using Transaction SM51

Special Destinations and RFC Groups

Configuring SNC: Using CPIC from AS ABAP

Maintaining CPIC Destinations and Their SNC Options Using Transaction SM54

CPIC: AS ABAP → AS ABAP

CPIC: Start an External Program over a Gateway

CPIC: Registered Program

Configuring SNC: Printing

Configuring SNC: SAProuter → SAProuter

C Program Interfaces

Interfaces to External CPIC Programs

Interfaces to External RFC Programs

Appendixes

Sample SNC Scenario

SNC-Related Tables on AS ABAP

Maintenance Utilities on AS ABAP

SNC Messages on AS ABAP

Using the SAP Cryptographic Library for SNC

Scenarios

SNC Scenario 1: Using a Single Key Pair for ALL Components

SNC Scenario 2: Using Individual Key Pairs for Components

Configuring the Use of the SAP Cryptographic Library for SNC

The SAP Cryptographic Library Installation Package

Recommended Locations of Files

Configuring SNC for Using the SAP Cryptographic Library on the AS ABAP

Installing the SAP Cryptographic Library on the AS ABAP

Setting the Trust Manager Profile Parameters

Creating the SNC PSE

Importing the SNC PSE

Exporting the SNC PSE

Exchanging Public-Key Certificates Starting on the AS ABAP

Exporting the AS ABAP's Public-Key Certificate

Importing Public-Key Certificates on the AS ABAP

Connection-Specific Configurations

Making the Access Control List Entries on the Application Server

Setting the SNC Profile Parameters

Configuring SNC for Using the SAPCRYPTOLIB Using SAPGENPSE

Installing the SAP Cryptographic Library on an Arbitrary Server

Creating a PSE for the Server Using SAPGENPSE

Creating the Server's Credentials Using SAPGENPSE

Checking the Application Server's User (Windows)

Exchanging Public-Key Certificates

Exporting the Server's Certificate Using SAPGENPSE

Maintaining the Server's Certificate List Using SAPGENPSE

Connection-Specific Configurations

Additional Functions

Deleting the Server's Credentials

Changing the PIN

Renewing the Server's Certificate

Exporting a PKCS#12 File

Importing a PKCS#12 File

The Configuration Tool's Generic Command Line Options

Using SNC Client Encryption for Password Logon

Preparing SAP NetWeaver Application Server ABAP

Installing SNC Client Encryption

Configuring SAP GUI for Windows

How SNC Client Encryption Works

Additional Information

SNC Names, SSO, and User Mapping

Performing an Unattended Installation

Confirming SNC Connections

Troubleshooting SNC Client Encryption

Enabling Traces for SNC Client Encryption

Encrypting Internal Server Communication of SAP NetWeaver Application Server ABAP

Transport Layer Security on the AS Java

Configuring the Use of SSL on the AS Java

Installing the SAP Cryptographic Library for SSL

Maintaining ICM Parameters for Using SSL

Additional SSL Ports

Configuration of the AS Java Keystore Views for SSL

Configuring the SSL Key Pair and Trusted X.509 Certificates

Adding New SSL Access Points

Maintaining SSL Access Points

Creating a Client PSE

Testing the SSL Connection

Using SSL With an Intermediary Server

Configuring SSL When the SAP Web Dispatcher is the Intermediary Server

Configuring the SAP Web Dispatcher to Terminate the SSL Connection

Configuring SNC: AS Java to AS ABAP

Installing the SAP Cryptographic Library on the AS Java for SNC

Creating an SNC PSE for the AS Java

Creating Credentials for the AS Java

Exchanging Public-Key Certificates

Maintaining the System ACL on the AS ABAP

Setting the SNC Parameters

Configuring SNC Between the UME and an ABAP-Based System

Requirements for the System User for UME-ABAP Communication

Configuring SNC Between an iView and an ABAP System

Destination Service

Maintaining HTTP Destinations

Maintaining RFC Destinations

Destination Service API

Interfaces and Classes for Using the Destination Service API

Examples for Using the Destination Service API

Configuring SSL Between the UMEand an LDAP Directory

Importing the Root Certificate of the LDAP Directory

Changing the UMELDAP Configuration

Troubleshooting

Secure Connection Factory API for HTTPS Clients

Interfaces and Classes for Using the Secure Connection Factory

Examples for Using the Secure Connection Factory

Reference

Additional Keystore and Cryptographic Functions

Managing Key Storage Views

Managing Entries

Creating a Key Pair and Public-Key Certificate

Managing Code-Based Permissions

Managing the Credentials and Trusted Certificates to Use SSL

Managing Cryptography Providers

The SAP Cryptographic Library Installation Package