Authenticating the TREX Name Server

Open the <TREX_Directory>\TREXcert.ini configuration file on the TREX Web server with a text editor.

In the [WEBSERVERCERTIFICATEnn] section, replace the entry nn with 1 when you enter the first client certificate. If a client certificate has already been entered, number other entries sequentially. You can enter as many client certificates as you want. You need to number these in ascending order.

In the parameters subject= and issuer=, enter the owner and issuer of the client certificate.

You enter the information displayed into the TREXcert.ini configuration file as follows:

[WEBSERVERCERTIFICATE2]

subject=CN=myhost.mydomain, OU=mydepartment, O=mycompany, L=mycity, ST=mystate, C=m country, EMail=myaccount@mydomain

issuer=CN=My Certificate Authority (CA), OU=Certificate Center, O=CA Company, L=CA City, ST=CA State, C=CA Country, EMail=caaccount@ cacompany.com

Note the following:

• Names - The holder of the certificate is known as the owner in the SAPGENPSE cryptography tool and as the subject in the configuration file.

  Several names are permitted for the following information in the configuration file:

  Information	Name in TREXcert.ini
  State	ST= und S=
  E-mail Address	E-Mail= and E=

  The other names need to be entered into the configuration file exactly as they appear in the keystore, that is, 0= is the organization, L= is the location, and so on.

• Spelling – The spelling of the entries in the configuration file must be exactly the same as in the keystore. Pay particular attention to lower- and uppercase and to the spacing in parameter values.

• Order - The order of the values in the parameters subject= and issuer= is irrelevant. For example, both subject=CN=myhost.mydomain, OU=mydepartment, O=mycompany, ... and subject=O=mycompany, OU=mydepartment, CN=myhost.mydomain, ... are permitted.

• Line breaks - All values for one parameter (for example, in subject=), must be on a single line. Separate entries on the line using commas and spaces as in the example below.

  issuer=E=caaccount@ cacompany.com, C=CA Country, ...

Save the TREXcert.ini file and close the editor.

Log on with the user that you used to install TREX.

Stop TREX.

Go to the TREX installation directory and then into the configuration directory of the Web server:

cd <TREX_Directory>/Apache/conf

Open the httpd.conf configuration file.

In the Apache Web server configuration file httpd.conf search for the line with the second instruction SSLRequire, which is within the tags <Location /TREX> and </Location> The httpd.conf configuration file is delivered in the following form by default:

<Location /TREX>
SetHandler trex-handler
#   usage of SSLRequire:
#   standard apache example:
#   SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#   SAP EP example
#       SSLRequire      (%{SSL_CLIENT_S_DN} eq "/C=DE/ST=BW/L=Walldorf/O=SAP Portals/OU=TREX/CN=p54896 client/Email=andreas.mustermann@sap.com" and \%{SSL_CLIENT_I_DN} eq "/C=DE/ST=BW/L=Walldorf/O=SAP Portals/OU=TREX/CN=CA TREX/Email=andreas.mustermann@sap.com" )
</Location>
                  

The instruction SSLRequire is commented out by default. To activate it, remove the comment sign (#) from the line SSLRequire.

Add the entry for the Subject and Issuer of the TREX name server after the entry for the Subject and Issuer for the TREX Java client.

1. Enter the Owner (Subject) and Issuer for the client certificate in the following form:

   SSLRequire (%{SSL_CLIENT_S_DN} eq "<Owner(Subject)>" and %{SSL_CLIENT_I_DN} eq "<Issuer(Issuer)>")

2. Link the two entries with parentheses (…) in the following way:

   (Subject/Issuer Java Client)or(Subject/Issuer Name Server )

   Example

   (%{SSL_CLIENT_S_DN} eq "/C=DE/ST=Baden Wuerttemberg/L=Walldorf/O=SAP AG/OU=TREX/CN=TREX Java Client/Email=my.account@sap.com" and %{SSL_CLIENT_I_DN} eq "/C=DE/ST=BadenWuerttemberg/L=Walldorf/O=CA Company/OU=Certificate Center/CN=My Certificate Authority/Email=ca.account@ca-company.com")

   or\

   (%{SSL_CLIENT_S_DN} eq "/C=DE/ST=Baden Wuerttemberg/L=Walldorf/O=SAP AG/OU=TREX/CN=TREX Java Client/Email=my.account@sap.com" and %{SSL_CLIENT_I_DN} eq "/C=DE/ST=BadenWuerttemberg/L=Walldorf/O=CA Company/OU=Certificate Center/CN=My Certificate Authority/Email=ca.account@ca-company.com" )

   Note

   You find the information on the Owner and Issuer of the client certificate in the SAPSSLS.pse keystore using the following SAPGENPSE command:

   sapgenpse get_my_name -p SAPSSLS.pse

   Caution

   Note that you have to enter the owner and issuer in two different places in httpd.conf. There is a tag <Location /trex> tag (TREX in lowercase) and a <Location /TREX> tag (TREX in uppercase).

Save the configuration file and close the text editor.

Restart TREX.