SAP WebDispatcher SSL

[former_member301120]

Hello to all,

we've got 2 domains with different IP adresses pointing to our webdispatcher.

a.domain.de

b.domain.de

Now I've enables ssl.

If I create the reqest files the first one works fine:

sapgenpse get_pse -p SAPSSLS.pse -x pin -r a.req "CN=a.domain.de, OU=ABC, O=ABC, C=DE"

Now if I want to create the second request file with:

sapgenpse get_pse -p SAPSSLS.pse -x pin -r b.req "CN=b.domain.de, OU=ABC, O=ABC, C=DE"

I get an error:

get_pse ERROR: PSE already exists "/usr/sap/WDP/W00/sec/SAPSSLS.pse"

So my questions:

- Couldn't I import two private certificates in one PSE?

- Do I need a explicit webdispatcher for each subdomain?

Best regards

Christian

[tsenol]

I have same issue to solve. Does anyone have answer for using 2 different ssl in a web dispatcher?

Regards

Tutku

[Former Member]

Can we conclude even with the latest NW7.3 Web Dispatcher, one SAP WD with multiple hostnames/IPs cannot have multiple SSL certificates (one for each FQDN)?

[Former Member]

Hello,

No, it is now indeed possible to use a SAP Web Dispatcher using a sngle SSL certificate with 2 Subject Alternate Names. I generate the Web Dispatcher PSE with transaction STRUST from Netweaver Abap >= 7.30. Our internal PKI CA has been configured to accept to sign these double named certificates.

I have already explained that in other SCN threads.

Best Regards,

Olivier

[Former Member]

Hi Oliver,

appreciate on your sharing:

it can be achieved with Subject Alternate Name(SAN) cert using STRUST with alternate names field.

further clarifications on front end browser output. What will it be if:

1) SAN cert with a.domain.com and b.domain.com. User hit a.domain.com. When the cert is opened, what DN is being shown?

2) single cert with <SID>. User hit a.domain.com or b.domain.com. Will it cause any browser error or warning?

LAstly, can SAPGENPSE generate SAN CSR for a public CA to sign?

THanks for your help!

[Former Member]

Hi Roger,

1) The DN shown when the cert is open, is the one you chose to put first when creating the cert in STRUST. In my case, I use Windows servers and they are in both the Windows domain and in a DNS domain. The Windows server has a hostname and also a DNS alias used for disaster recovery.

In the past we called SAP web applications using the hostname and the DNS domain.

Now we have a disaster recovery system and we use SPNego/Kerberos SSO which means we have to call SAP web applications using the DNS alias and the Windows Domain.

But as the old URLs have links configured everywhere in the intranet, for compability reasons, we needed to be able to call the applications with both URLs :

Old one : https://hostname.dnsdomain/sap/....      for compatibility

New one : https://dnsalias.windowsdoamin/sap/.... for disaster recovery and Kerberos.

Therefore the need for a certificate with both these Alternate Subject Names.

When I create the PSE with STRUST, I enter both names separated by ;

When the cert is displayed from the browser, I get :

Delivered to : dnsalias.windowsdoamin

and in the Details tab, I get:

Object : CN=dnsalias.windowsdoamin  OU = ....

Alternate Names :

DNS Name =dnsalias.windowsdoamin

DNS Name = hostname.dnsdomain

2) I don't understand what you call single cert with <SID>

3) I never succeeded to use SAPGENPSE to generate SAN CSR. Therefore I don't think it is possible. I only succeeded using the file option of transaction STRUST.

Regards,

Olivier

[Former Member]

Great stuff Oliver. Now I can understand your background of using this.

My background of using multiple SSL for one Dispatcher is because of the design of a frontend DMZ server for multiple backend ERP, BW and NWGW.

we intend to use different virtual IPs and DNS records within a Web Dispatcher in DMZ server as a SSL terminator.

So the the scenario will be having Internet users hitting SSL URLs:

erp.abc.com

bw.abc.com

nwgw.abc.com

intended to use multiple SSL Certs but a single SAP WD can only support a single SSL Cert.

1. Let say we use CN=abc.com and perform self sign using STRUST. When user hit any of the 3 above URLs, what will the browser complain? Or no issues?

2. Since STRUST can generate SAN certs, can it generate SAN or wildcard CSR?

[Former Member]

Hello Roger,

1. If you set CN=abc.com the browser will always complain that the certificate is wrong and the connection unsafe because the CN would be different from the URL.

In my opinion, you would have to set CN=*.abc.com but I think that this kind of certificate is very expensive to get signed by a "well known" CA.

2. I've never had to use STRUST for wildcard CSR but I think it should be possible. You should gib*ve it a try.

In your case, I would try to use STRUST to create a PSE certificate with CN=erp.abc.com and with 3 Alternate Subject Names :

erp.abc.com

bw.abc.com

nwgw.abc.com

You should check in advance with the CA if they are able to sign this kind of certifcates.

Best Regards,

Olivier

[Former Member]

great to see your reply again Oliver. Cheers!

1. STRUST to generate wildcard CSR is possible. But like what you indicate it is damn expensive. About $499/yr. Interesting, some of the browser does not support wildcard SSL and it is even mentioned in SAP note that wildcard CN is not a recommended or even recognized way on the Internet.

2. I have check your another SCN thread that once you got your own CA PKI to sign the cert, it will appear in the SAN of STRUST. I tried it in my test server and there is no way to get it in the SAN field of STRUST. The only way for me is to insert in the DN field with multiple CN separated by ;

Am I right?

[Former Member]

Hello Roger,

2.  This is correct : To generate the self signed certificate, I enter multiple CN separated by ";".

I see my 2 SAN in STRUST only after importing the signature from the PKI.

Best Regards,

Olivier

[Former Member]

Hi Oliver,

i tried to creat a certificate request in STRUST -> create   with two CN 's seperate by ";"

mit.vaillant-group.com

groupnet.vaillant-group.com

But i got following error "Fields contained invalide characters"

Could you explane the right way in STRUST?

Thank you

Pia Menzel

[Former Member]

Hello Pia,

I just re-did  a test to remember how to do it.

STRUST --> Right Click on File --> Create --> popup "Create PSE" opens up.

Click on "pencil" button (Revise DN)

Choose

Algorithm : RSA with Sha-1

Key Length : 2048

In the DN field, I enter my 2 CNs separated by ;

CN=name1.domain1,OU=xxxx,O=company,C=yy ; CN=name2.domain2,OU=xxxx,O=company,C=yy

Then I have to choose the PSE Filename and directory to save it.

If I double click on "File" I am able to load the PSE and to generate a CSR to have it signed by our PKI. On the PKI screen, I have also to enter both FQDN as Alternate Subject Names.

When I load the p7b file (answer from the PKI) in STRUST in the SSL certificate, I can see 2 dNSNames in the Subject (Alt.) field.

When I save, I can now copy the signed PSE in the sec directory of the SAP Web Dispatcher and call https Urls using both names without browser errors.

Best Regards,

Olivier

[Former Member]

PS : What a crappy forum software ! My message is now so badly formatted....  

[Former Member]

Hi Olivier,

thanks a lot for your fast help . Now i could create the cert request and sended to PKI, hope the response works fine.

Best Regards

Pia

[Former Member]

HI Olivier,

now i got the respons from PKI and the import via STRUST works fine, i can see :

But if i export the server pse as SAPSSLS.pse and copy to WEb dispatcher in DMZ i get this error with sapgenpse tool:

sapgenpse get_my_name -p SAPSSLS.neu.pse

get_my_name: Couldn't open PSE "/usr/sap/WD2/W00/sec/SAPSSLS.neu.pse"

I tried it with and without password, but it not works. PSE file has all rights and is assigned to the right user "wd2adm"

What can caused this error?
Could you helb me?

Regards

Pia Menzel

[Former Member]

Hi Pia Menzel,

You should copy the PSE from your Web Dispatcher to your ABAP store server and import in via STRUST. Thereafter, add the signed certificate to the PSE.

Then export the PSE and copy back to your Web Dispatcher.

[Former Member]

Hello Pia,

I don't understand what you're trying to do with sapgenpse. After importing the PKI response with STRUST, you just save the signed PSE to the web dispatcher /sec directory, restart the web dispatcher and all should be ok.

I don't use sapgen pse at all, only STRUST.

Best Regards,

Olivier

[Former Member]

Morning Olivier,

i used sapgenpse to check the signed certificate and the authorisation.

OK i restarted my WD with new SAPSSLS.pse but i get also an error:

Thr 139814821607168] *** ERROR =>   secudessl_Create_SSL_CTX():  PSE "/usr/sap/WD2/W00/sec/SAPSSLS.pse": unable to use! [ssslsecu_mt. 1735]

[Thr 139814821607168] No Secude Error present in trace stack!

[Thr 139814821607168] *** ERROR => SapISSLAddCredential(): Error SSSLERR_PSE_ERROR trying to create SERVER Credential

        for "/usr/sap/WD2/W00/sec/SAPSSLS.pse" [ssslxxi_mt.c 2324]

[Thr 139814821607168] *** ERROR => Initialization of SSL library failed -- NO SSL available!

[Thr 139814821607168] =================================================

[Thr 139814821607168]

[Thr 139814821607168] <<- ERROR: SapSSLInit(read_profile=1)==SSSLERR_PSE_ERROR

[Thr 139814821607168] *** ERROR => IcmServInitSSL: SapSSLInit (rc=-40): SSSLERR_PSE_ERROR [icxxserv_mt. 251]

What i did to create SAPSSLS.pse:

- i created a cert request in STRUST in one of our ABAP Systems (Rel 731)

- send to PKI (by customer)

- after response from PKI i imported the cert response (with root and intermediate cert) in the Server PSE in Strust

- then i export this PSE to file system (base64)

- and copy the SAPSSLS.pse to sec directory of WD (Rel 730)

- and now i get the SSL error

What i have done wrong?

Regards

Pia

[Former Member]

Hello Pia,

Strange, I've never had this error.

How did you create the PSE with STRUST ?

Did you choose "File --> Right click --> Create"  and not "SSL server standard --> Right click --> Create" ?

Do you have the "ticket" file in the sec directory of the web dispatcher ?

Best Regards,

Olivier

[Former Member]

Here is an extract of a SAP Web Dispatcher Trace file when starting SSL with a STRUST generated PSE :

[Thr 12020] =================================================

[Thr 12020] = SSL Initialization    platform tag=(NTAMD64)

[Thr 12020] =   (720_REL,Nov 20 2011,mt,ascii,SAP_UC/size_t/void* = 8/64/64)

[Thr 12020]   profile param "ssl/ssl_lib" = "D:\usr\sap\DEV\WebDisp\sapcrypto.dll"

[Thr 12020]            resulting Filename = "D:\usr\sap\DEV\WebDisp\sapcrypto.dll"

[Thr 12020] =   found SAPCRYPTOLIB  5.5.5C pl32  (Apr  2 2011) MT-safe

[Thr 12020] =   current UserID: TESTBED\SAPServiceDEV

[Thr 12020] =   using SECUDIR=D:\usr\sap\DEV\WebDisp\sec

[Thr 12020]   profile param "ssl/server_pse" = "D:\usr\sap\DEV\WebDisp\sec\SAPSSLS_DEV_testbed_bpa_signed.pse"

[Thr 12020]            resulting Filename = "D:\usr\sap\DEV\WebDisp\sec\SAPSSLS_DEV_testbed_bpa_signed.pse"

[Thr 12020] =  secudessl_Create_SSL_CTX():  PSE "D:\usr\sap\DEV\WebDisp\sec\SAPSSLC.pse" not found,

[Thr 12020] =      using PSE "D:\usr\sap\DEV\WebDisp\sec\SAPSSLS_DEV_testbed_bpa_signed.pse" as fallback

[Thr 12020] =  secudessl_Create_SSL_CTX():  PSE "D:\usr\sap\DEV\WebDisp\sec\SAPSSLA.pse" not found,

[Thr 12020] =      using PSE "D:\usr\sap\DEV\WebDisp\sec\SAPSSLS_DEV_testbed_bpa_signed.pse" as fallback

[Thr 12020] ******** Warning ********

[Thr 12020] *** No SSL-client PSE "SAPSSLC.pse" available

[Thr 12020] *** -- this will probably limit SSL-client side connectivity

[Thr 12020] ********

[Thr 12020] = Success -- SapCryptoLib SSL ready!

[Thr 12020] =================================================

Best Regards,

Olivier

[Former Member]

Hi Olivier,

i configured a lot of Web dispatcher with SSL in the past, i know the WD trace for SSL  .

And before i switched to this new certificate the Web dispatcher was running with an SSL certificate without errors. And if i switch to the "old" SAPSSLS.pse it works also fine.

Only with the new one it not works.

Regarding

How did you create the PSE with STRUST ?

Did you choose "File --> Right click --> Create"  and not "SSL server standard --> Right click --> Create" ?

--> i used "SSL server standard" --> is that the problem ?

Regards

Pia

[Former Member]

Pia,

--> i used "SSL server standard" --> is that the problem ?

I think so. This entry is to create a SSL PSE for the abap ICM.

Try to recreate your PSE with "File --> Right click --> Create".

That"s the way I do it and it works for me for several production systems...

Best Regards,

Olivier

[Former Member]

Hi Olivier,

thanks a lot.

I will try it again via "FILE". Hope my customer get no additional costs if he send the next cert request to Symantec.

We will see.

Regards

Pia

[Former Member]

Hi,

we're using SAPNW7.3 based Webdispatcher.

Is this thread also useful for 7.3?

Or is it now possible to use more than one domain (with enabled ssl) with this version?

Kind regards,

Stefan

[former_member184682]

Hello,

Is it now possible to use two CN's in one PSE on the webdispatcher? Or a reverse proxy like Apache is the onlly way?

Thanks

Chan

[Former Member]

Hello Christian,

You can use a certificate that is valid for both domains.

Instead of having one certificate for "a.domain.de" and another for "b.domain.de", you would have one for "*.domain.de".

This kind of certificate is a bit more expensive than a certificate for one domain, but you can use it to access more backend systems using this one certificate. You should see if the extra costs are worth it in your specific scenario.

Kind regards, Wilbert

Edit: typo

Edited by: Wilbert Jeuken on Jan 3, 2011 4:34 PM

[former_member301120]

Hello Wilbert,

we don't want to use a wildcard certificate.

SAP has answered following:

The configuration of SAP Web Dispatcher to maintain two different SSL
server PSE at the same time is not documented in Notes or help.sap.com.
So there is no information confirming that the SPA Web Dispatcher is
able to work with multiple PSE files.

We now prefer to use an apache based reverse proxy.

It is also supported by SAP:

Yes, the Apache Web server can be used as a reverse proxy.

I'd suggest you to refer to the following links :

http://help.sap.com//saphelp_nw70/helpdata/en/18/5cea2296190e4cb7faf9468ad793ea/frameset.htm

https://wiki.sdn.sap.com/wiki/display/BSP/Using+Proxies

Christian

[hofmann]

Hi,

a certificate with SAN isn't an option?

As Apache handles several certificates it doesn't do load balancing like web dispatcher does (connection to message server). Or do you want to put the Apache in front of the web dispatcher?

br, Tobias

[former_member301120]

Hello Tobias,

I didn't mind loadbalancing till now. It's quite a important point.

Have you planned a equal scenario?

I think I'll run APACHE as reverse proxy. APACHE should do the SSL-Termination and SAP-Webdispatcher should do the rest

What do you think? Might it work?

br, Christian

[hofmann]

Hi,

letting something other than Web Dispatcher doing the SSL termination is quite common:

- Dedicated hardware with SSL chip to off-load the SSL work

- Apache or other reverse proxy that serves as an entry point for HTTP requests (not limited to SAP)

and having the Web Dispatcher behind these to do the load balancing:

user <-> reverse proxy <-> web dispatcher <-> SAP

Staging the access allows you to also sequentially increase the security:

- Generall access to the reverse proxy

- Web Dispatcher is in a seperated DMZ (secured by FW) that only allows connection done from the reverse proxy

- backend systems in a network that again only allows connections from the Web Dispatcher

br,

Tobias

[former_member301120]

Hello Tobias,

thank you for your advice.

I'll will set up it in this way and post my results.

Christian

[former_member301120]

Hello,

we use a reverse proxy to determintate SSL and forward the request to SAP WebDispatcher

Everything works fine.

[jay_b2]

This message was moderated.

[jay_b2]

I'm implementing exactly what you have discussed here and would like to confirm if this can be implemented using Web Dispatcher as Reverse proxy.

i.e. Clientssl-web dispatcher as reverse proxy (SSL Termination) -- web dispatcher for load balancing -- sap server

Do we face any issue with SSL certificates if we have two reverse proxies & two web dispatchers operating in parallel ?

[former_member218672]

Hello Chris,

Try below steps.

1) downloaded the SAP cryptographic software from service.sap.com/tcs . select the correct one for your platfrom

2) Extract it with sapcar -xvf filename.sar

for windows /ntintel directory would be created and the following files would be extracted

for example

C:\saprouter\ntintel\sapcrypto.dll

C:\saprouter\ntintel\sapgenpse.exe

C:\saprouter\ticket

3) It is necessary to define the environment variable for u201CSECUDIRu201D and u201CSNC_LIBu201D under system account.

the SNC_LIB path may be vary if you are using 64 bit windows server following is for 32 bit windows server.

SECUDIR -> C:\saprouter\

SNC_LIB -> C:\saprouter\ntintel\sapcrypto.dll

4) Check if the environment of the user running saprouter contains the environment variable SNC_LIB

5) now apply for a SAProuter certificate from the SAP Trust Center Service of SAP service marketplace

service.sap.com/tcs -> SAP Trust Center Service in Detail -> SAProuter Certificates

so you get your Distinguished Name.

6) Execute the following command in the \saprouter\ntintel directory in order to generate your certificate to be exchanged with SAP

sapgenpse get_pse -v -r certreq -p local.pse "Distinguished Name"

follow the above steps for generate your certificate

Regards,

Sen

[former_member301120]

Hello Sen,

thanks for your reply.

With one certificate alternativly one distinguished name, the ssl functions works fine.

Now I have two domains, pointing to my server. Also I have two distinguished names (DN) with different IP-adresses.

If I want to generate the second certificate request for the other DN, I get the error above.

Is it possible to assign to DN to one PSE alternativly to assign to different PSE files to profil parameter ssl/server_pse.

Regards Christian

[hofmann]

If you want to use 1 SSL certificate, you'll need to use one that is valid for both domain names. Per default, a SSL certificate is valid for one name only. (Which makes sense, as SSL certificates are used to identify a single server)

Fortunately SSL certificates can include a principal name and alternative names => they can be valid for more than 1 server name (http://en.wikipedia.org/wiki/Subject_Alternative_Name).

Create a SSL certificate that also contains SAN names for your other server name.

br,

Tobias