SSL with HANA and BI4 Feature Pack 3
Secure Sockets Layer (SSL) with HANA and BI4 Feature Pack 3 requires configuration on the HANA server and BI4 server. The following steps will show how to configure SSL using OpenSSL and a certificate obtained by from a Certificate Authority (CA).
This blog will cover the OpenSSL Crypto Library, however HANA can also be configured using the SAP Crypto Library.
Confirm that OpenSSL is installed
shell> rpm -qa | grep -i openssl
Confirm that OpenSSL is 64-bit
shell> file /usr/bin/openssl
openssl: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), for GNU/Linux 2.6.4, dynamically linked (uses shared libs), stripped
Confirm there is a symlink to the libssl.so file
If not, create one as the root user
shell> ln -s /usr/lib64/libssl.so.0.9.8 /usr/lib64/libssl.so
This blog won’t go into details of how SSL works, but in generic terms you’ll need to create a Certificate Singing Request (CSR) from the HANA server and send that to a CA. In return, the CA will give you a Signed Certificate and a copy of their Root CA Certificate. These, then need to be setup with HANA and the BI4 JDBC and ODBC drivers.
Creating the Certificate Signing Request
shell> openssl req -new -nodes -newkey rsa:2048 -keyout Server_Key.key -out Server_Req.csr -days 365
Fill out the requested information according to your company:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) :
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) :
Common Name (eg, YOUR name) :
Email Address :
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password :
An optional company name :
This will create two files
- Key: Server_Key.key
- CSR: Server_Req.csr
The CSR needs to be sent to the CA, which in turn will give you a signed certificate and their Root CA Certificate.
Convert the Root CA Certificate to PEM
The Root CA Certificate may come in the DER format (.cer extension), HANA requires the cert in PEM format. Therefore, we will need to convert it using the command
shell> openssl x509 -inform der -in CA_Cert.cer -out CA_Cert.pem
HANA SSL Configuration
Copy both the Signed Cerficiate and Root CA Certificate to the HANA server. For HANA SSL to work, we need to create two files:
The key.pem key store file contains the certificate chain, which includes your servers key (Server_Key.key), the CA’s Signed Certificate and the Root CA Certificate. Whereas the trust.pem trust store file contains the Root CA Certificate.
Create the key.pem and trust.pem trust stores
shell> cat Server_Cert.pem Server_Key.key CA_Cert.pem > key.pem
shell> cp CA_Cert.pem trust.pem
Copy the files to the user’s home directory
In the user’s home directory create a .ssl directory and place both the key.pem and trust.pem files here,
Configure the certificates in HANA
Once the key.pem and trust.pem files have been created they need to be configured in HANA.
In HANA Studio go to
- Configuration tab
- Expand indexserver.ini
- Expand communication
- Configure the entries related to SSL
Start and Stop HANA to pick up the SSL configuration
- HDB stop
- HDB start
HANA Studio Configuration
When setting up the connection to HANA, check the option ‘Connect using SSL’, as seen below.
To confirm the connection has SSL, look for the lock icon on the server icon, as seen below.
BI4 Feature Pack 3 SSL Configuration
SSL in BI4 needs to configured for the HANA connectivity you plan to use.
For JDBC SSL configuration, we’ll need to add the trust.pem trust store to the Java Key Store (JKS) using the keytool utility provided by the JDK/JRE. This is done via the command line. Change the paths for your own configuration:
Add trust.pem to the JKS
C:\Documents and Settings\Administrator>“C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\jre\bin\keytool.exe” -importcert -keystore “C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\jre\lib\security\cacerts” -alias HANA -file trust.pem
You will be prompted for the keystore password. The default password is: changeit
When prompted to ‘Trust this certificate’ enter yes. The alias can be any value, however it must be unique in the keystore.
Confirm that your certificate has been added to the keystore
C:\Documents and Settings\Administrator>“C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\jre\bin\keytool.exe” -list -keystore “C:\Program Files (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\jre\lib\security\cacerts” -alias HANA
If successful, you will see trustedCertEntry in the output, as below
Information Design Tool (IDT) Configuration
In IDT, the connection will need to be setup with the JDBC Driver Property encrypt=true to make the connection use SSL when connecting to HANA,
Once the HANA client driver has been installed, you can set up a ODBC connection for HANA. To connect via SSL, check the box ‘Connect using SSL’, as below:
If you added any Special property settings’, they won’t be displayed in the driver configuration. To view them, launch the Windows Registry Editor and go to the key:
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\<Your Data Source Name>
Installing the CA Root Certificate
Depending on which CA you get the certificate signed from, you may run into SSL errors. For example, in Crystal you may see this error,
To resolve this, install the CA Root Certificate allowing it to be trusted by the server.
- Copy the CA Root Certificate to the machine where the error is coming from
- Double click on the certificate and click ‘Install Certificate’
- Click next
- Select the first option and click next
- Click finish
Confirming if SSL is being used
Using a tool like Wireshark, the communication between the server and client can be traced, as seen below to verify that SSL is being used.