SAP Table Connector

Back Next

Create an OpenSSL certificate

Before you create an OpenSSL certificate, you need to perform the prerequisite tasks.

Download and install OpenSSL on the Secure Agent machine.

Based on the operating system of the machine that hosts the Secure Agent and the SAP system, download the latest available patch of the SAPGENPSE Cryptography tool from the SAP Service Marketplace.

By default, the SAPGENPSE files are extracted to the

nt-x86_64

directory.

Configure the following SAP parameters:

icm/server_port, ssl/ssl_lib, sec/libsapsecu, ssf/ssfapi_lib, ssf/name, icm/HTTPS/verify_client, ssl/client_pse

, and

wdisp/ssl_encrypt

For more information, see the SAP documentation.

To create a self-signed certificate using OpenSSL, perform the following tasks:

From the command line, set the

OPENSSL_CONF

variable to the absolute path to the

openssl.cfg

file.

For example, run the following command:

set OPENSSL_CONF= C:\OpenSSL-Win64\bin\openssl.cfg

Navigate to the

<openSSL installation directory>\bin

directory.

To generate a 2048-bit RSA private key, run the following command:

openssl.exe req -new -newkey rsa:2048 -sha1 -keyout <RSAkey File_Name>.key -out <RSAkey File_Name>.csr

When prompted, enter the following values:

Private key password (PEM pass phrase). Enter a phrase that you want to use to encrypt the secret key. Re-enter the password for verification.

Make a note of this PEM password. You need to keep this password handy while creating a self-signed key and PKCS#12 certificate.

Two-letter code for country name.

State or province name.

Locality name.

Organization name

Organization unit name.

Common name (CN). Mandatory.

Enter the fully qualified host name of the machine that hosts the Secure Agent.

Email address.

Optionally, enter the following attributes that you want to pass along with the certificate request:

Challenge password.

Optional company name.

A RSA private key of 2048-bit size is created. The

<RSAkey File_Name>.key

and

<RSAkey File_Name>.csr

files are generated in the specified directory.

To generate a self-signed key using the RSA private key, run the following command:

openssl x509 -req -days 11499 -in <RSAkey File_Name>.csr -signkey <RSAkey File_Name>.key –out <Certificate File_Name>.crt

When prompted, enter the PEM pass phrase for the RSA private key.

The

<Certificate File_Name>.crt

file is generated in the specified directory.

To concatenate the contents of the

<Certificate File_Name>.crt

file and the

<RSAkey File_Name>.key

file to a

.pem

file, perform the following tasks:

Open the

<Certificate File_Name>.crt

file and the

<RSAkey File_Name>.key

files in a Text editor.

Create a file and save it as

<PEM File_Name>.pem

Copy the contents of the

<Certificate File_Name>.crt

file and paste it in the

.pem

file.

Copy the contents of the

<RSAKey_Name>.key

file and append it to the existing contents of the

.pem

file.

Save the

<PEM file name>.pem

file.

To create a PKCS#12 certificate, run the following command from the command line:

openssl pkcs12 -export -in <PEM File_Name>.pem -out <P12 File_Name>.p12 –name “domain name”

When prompted, enter the following details:

The PEM pass phrase for the

.pem

file.

An export password for the P12 file. Re-enter the password for verification.

Make a note of this export password for the P12 file. You need to keep this password handy while creating a Java keystore file to connect to SAP through HTTPS.

The

<P12 File_Name>.p12

file is generated in the specified directory.

To create a Java keystore file, enter the following command:

keytool -v -importkeystore -srckeystore <P12 File_Name>.p12 -srcstoretype PKCS12 -destkeystore <JKS File_Name>.jks -deststoretype JKS -srcalias "source alias" –destalias "destination alias"

When prompted, enter the following details:

Password for the destination keystore, the JKS file.

Make a note of this password. You need to keep this password handy while creating an SAP Table connection.

Password for the source keystore, the P12 file. Enter the Export password for the P12 file.

The

<JKS File_Name>.jks

file is generated in the specified directory.

While enabling HTTPS in an SAP Table connection, specify the name and location of this keystore file. You also need to specify the destination keystore password as the Keystore Password and the source keystore password as the Private Key Password both in the SAP Table connection properties and in the SAP system.

Rename Saved Search

Table of Contents

SAP Table Connector

SAP Table Connector

Create an OpenSSL certificate

Create an OpenSSL certificate