Signature algorithm SHA256

[krishg]

NFE requires that CSR have the SHA256 algorithm instead of the usual SHA1... We generate key pair in the NWA key storage with 2048 RSA.. Unfortunately the signature algorithm on the key pair is SHA1 and not SHA256 as requested by government. As a result our CSR is rejected.

Is there any way to generate the key pair with signature algorithm SHA256 from Keystorage view (in NWA) or how do we go about generating one?

[krishg · Accepted solution]

We raised an OSS message and SAP responded that support for CSR with SHA256 is not provided until the next cryptolib release (patch 34 i think).

[Former Member · Accepted solution]

Dear Krish,

I am having the same issue in NW 7.3 Java . For me , the update did not solve the issue. Did you perform any other settings?

[Former Member · Accepted solution]

You can't specify the used algorithm in Key Storage, use SAPGENPSE instead and import the certificate to Key Storage. Use -a sha256WithRsaEncryption to specify the algorithm while creating the PSE.

[Former Member · Accepted solution]

Can elaborate more on using -a with that option?  The only ones published are RSA (default) and DSA and when I tried explicitly what you wrote it was an invalid option.

We had a situation where we requested our cert from the authority like we normally do with sapgenpse get_pse -p SAPSSLS.pse -r <certeq_name.req>-s 2048 "xxx.xxx.xxx, C=US"

We would get the response back and import it with

sapgenpse import_own_cert -c <cert file.crt> -r <intermed.crt> -r <root.crt> -p SAPSSLS.pse -x <pin>

This time the cert request came back from our authority as G2 (SHA-2).  The import failed with an FCPath error, but when l looked at the subject, all the variables were in fact in the certificate chain.  The one thing that was odd was that the "C" variable in the error was in quotes (e.g. "company name, inc.") instead of C=comany name, inc.

I asked the authority admin to reprocess my request as SHA-1.  He sent me a response and bundle of root+intermediate.  Ran the same command, and the SSL cert imported without incident.

Do we need to specify something in the initial request (sapgenpse get_pse...) to insure we get use an SHA-2 cert?  Or is there another reason my SHA-1 cert imported when the SHA-2 one gave the FCPath error?

[former_member816597 · Accepted solution]

Hi Guys,

Can you tell us how to upgrade SHA1 to SHA256 to SAP PI 7.4.

We are facing issue at Development and QA server of PI.

Thanks in advance.