Steps to Renew SSL Standard Instance Certificate (.pfx file)


Many times we receive renewed certificates from CA/Customer in .pfx format around certificate renewal time. As the SAP system won’t accept the .pfx certificate directly, we first need to convert it into a format accepted by the SAP system. To achieve this, below are the Steps to Renew SSL Standard Instance Certificate with a .pfx file.

Steps to Renew SSL Standard Instance Certificate

  • First, we need to convert the .pfx file to a .pse file so that we can import it in STRUSTSSO2, for this we will use sapgenpse on a local PC. Download and extract via https://support.sap.com/en/my-support/software-downloads.html -> Installations & Upgrades -> By Category -> SAP Cryptographic Software -> SAPCRYPTOLIB -> COMMONCRYPTOLIB 8
  • Use SAPCAR to exact your file
  • Put all files in the same folder
  • You will need a Global Root certificate from CA, execute the below command to convert file

# sapgenpse import_p12 -p “Path on PC\<SID>.pse” -r GlobalRoot.cer <path to .pfx file>

  • Take a backup of existing instance pse
    • STRUSTSSO2 -> Expand SSL Server Standard -> Double Click on Instance PSE
    • Double-click on DN on the right-hand side
    • PSE -> Save As -> File (Export PSE)
Renew SSL Standard Instance Certificate
  • Save the file as .pse
    • Note that the next step will overwrite the PSE, hence make sure you have backup.
  • Double-click on File from the Left-Hand side menu
  • Select the new PSE generated from the .pfx file, pse will be loaded on the right-hand side, double-click on it to verify its validity
  • PSE -> Save As -> SSL Server (DEFAULT)
Renew SSL Standard Instance Certificate
  • On the next screen Select the specific instance from the drop-down, and Select the Radio button to keep the certificate list i.e. Select No.
  • Confirm on the Next Screen.
Renew SSL Standard Instance Certificate
  • Once you select Yes, PSE will be overwritten, and this cannot be undone. Hence make sure you have a backup.
  • Save & then restart ICM via SMICM if the new cert is not reflected with the browser check.

References

  • SAP Note 2148457
  • SAP Note 1473710

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *

error: Content is protected !!
Exit mobile version