SAP Secure Login Server - your own CA on Hand ...

Technology Blogs by Members

Explore a vibrant mix of technical expertise, industry insights, and tech buzz in member blogs covering SAP products, technology, and events. Get in the mix!

Last Changed: 16th of November 2020

Motivation and Overview

After some time, I thought it is time to update the Document - SAP First Guidance – Implement SAP BW/4HANA in the Azure Cloud especially the topics for SAP Analytics Cloud and the SAP Analytic Cloud Connector which is necessary to overcome the Firewall Issues.

While I was configuring the SAP Cloud Connector (again on Azure Hyperscaler) there is a task - Configure a CA Certificate for Principal Propagation which I came to a interesting Side Note:

So: what is the (SAP) Secure Login Server (3.0) and what can it do for me?

Since I'm working since several Years with Azure Hyperscaler, my biggest Challenge was always to get a CA response for the server with the DNS *.azure.com. For SAP System which belongs to the *.sap.corp DNS we can create an own CA for these systems.

So I was trying to find a "transparent Solution" for this annoying issue and "Self-Signed" Certificates is not an Option for me at all, and that is the only suggestion you will get from SAP on many, many SAP Help Documentation.

In the End, I always ended by a Community Colleague gregorw (GitHub, Paasport - Gregor Wolf) who is one of the "real SAP Mentors" outside SAP. He let his mojo play on the systems and created the CA response based on let's encrypt (honestly I never got the whole story so far ... ;-))

See also the Blog from gregorw - Use a Let’s Encrypt certificate for SAP HANA or SAP NetWeaver AS ABAP

source - let's encrypt

Here we can see, what the SAP Secure Server can do for me - Out-of-the-Box PKI Login Server and PKI Integration.

source - SAP Help

SAP Help - SAP Cloud Platform Connectivity - Recommendations for Secure Setup

Implementation of the Secure Login Server 3.0

Nevertheless the SAP Help says using SWPM to install, you can also use the SUM to apply the necessary *.SCA files to a new or existing SAP 7.50 Java Application Server.

SAP Help - Installation and Installation File Names

Don't be surprised that you will not find a lot Blogs or additional Articles in the SAP Community. It seems we find again a hidden treasure here.

Components of the "SAP Secure Server"

Don't be to astonished about the latest updates of the files. It seems especially here, you will see where SAP is shifted there invests: everything goes Cloud.

necessary SCA components in addition

SAP NetWeaver Administrator - list of the components

Even there are only a few SCA files has to be applied, you might pick into a wasp nest, jumping from one problem to another, so I list some SAP Notes to read before you apply the SCA files.