SAP Router - certificate expiration date (problem)

[Former Member]

Hello,

I need to understand something regarding the SAP Router certificate...

Today I did a renew of SAP Router certificate, but I don´t understand why this new certificate has only 6 months of validity and not 1 year as the normal, as expected!

As you see in the following image the validity of the new certificate is to Web Jul 08 11:00:00 2015 and I renewed this certificate today! Very weird!

The following information is the output of the command: sapgenpse get_my_name -v

This is more weird when I go to SAP Marketplace and I check the list of all SAProuter certificates that have been ordered by my company and I see the information that this specific certificate has the expiration date of one year of validity (30.01.2016), which is, I think, the correct date.

Can you help me please to understand what´s the reason it doesn´t have 1 year of validity?

Thank you

samid raif

[former_member182657]

Hi Arménio Teles,

Hope you are doing good !!

I just checked the thread & saw your issue of still getting same dates.But i would suggest you to kindly follow below statement

Effective 07/18/2015 11:00 AM CET:
Certificates obtained before 04/15/2015 11:00 AM CET will no longer be supported. Only certificates issued by the new SAProuter CA will be accepted from this point on.

from the note  2131531 - New Root Certification Authority for saprouter certificates

Hope you'll get your answer from the above statement.

Good luck !!

[ChrisPS]

Hello Samid,
                   this is currently a known issue with our technical team responsible for the renewal of the saprouter certificates. They are working on a resolution. Apologies for any inconvenience caused. You will be able to renew the certificate again in six months where a certificate of one year as normal should be issued.

Regards,

Chris

SAP AGS Support

[Former Member]

Hello Chris,

Ok. Thank you for the information.

Tell me Chris... can you tell me when will this problem be solved?

Thank you,

samid raif

[ChrisPS]

Hello Samid,
                   unfortunately this information is not available at present.

Regards,

Chris

[Former Member]

Ok Chris, but I think this is very important... because as you know the SAP Router is a very important platform for all SAP customers... therefore for that reason I think that SAP should inform this problem in the portal with a message and report all the details about this subject!

For example... what will happen when the date of SAP Router reach the end (July 8)?! You will answer... "you need to renew your SAP Router certificate" ... OK... I question other thing, after the certificate renew what end date it will show?! (more 6 months?)

Thank you,

samid raif

[ChrisPS]

Hi Samid,
               I checked and the situation is as follows:

The SNC SAProuter certificate for our sapserv9 on the Service Marketplace will expire on 18 July 2015 therefore all renewed customer SNC certificate will also expire on the same date as a new CA certificate will need to be issued at this time.

The new CA for sapserv2 will soon be deployed to extend the expiry date and users will need to regenerate their SNC SAProuter certificates again in order to extend the SNC SAProuter certificate. No fixed date has been announced when this will happen but it will be before 18th July 2015.

Best regards,

Chris

[Former Member]

Hello Christopher Leonardand Gaurav Rana

I tried to solve this problem/situation by following the information that is mentioned in SAP note 2131531 (New Root Certification Authority for saprouter certificates) but unfortunately the new certificate show me the same expiration date of July 8 10:00:00 2015

I followed everything that is mentioned in Installing the sapcrypto library and starting the SAProuter | SAP Support Portal included the import the SAProuter SMP CA Root CA certificate with the command sapgenpse maintain_pk -a smprootca.der -p local.pse

Can you help me please?

Kind regards,

samid raif

[former_member185954]

Hello Samid,

What is the problem here , what issue are you trying to solve?

Regards,

Siddhesh

[ChrisPS]

Hi - reading the note the new extended validity of one year will only come into effect after

04/15/2015 11:00 AM CET for  all newly generated SAProuter certificate requests . Any requests before this show the shorter validity till July 2015 like you have seen.

So the solution is to use the current one and then after 04/15/2015 11:00 AM CET apply for a new certificate which then should be valid for one year.

Regards,

Chris

AGS Product Support

[former_member182657]

Hi Christopher Leonard,

Thanks for the response on thread & your valuable updates on the issue as well.

Regards,

Gaurav

[Former Member]

Hello Christopher Leonard

Ok! I will check this again after the 04/15/2015!

Thank you very much,

Kind regards,

samid raif

[former_member182657]

Hi Samid,

Would be best to raise SAP OSS for the issue.

Regards,

[former_member182657]

Hi Samid,

Can you tell me what is that (FCPath certificate level...)?

Here 'm not sure but FCPath means could be Full certificate path.

Maybe this situation is related with the expiration date of FCPath certificate level #1 !

Yes this issue could be just because of expiration of FCPath ion july 2015 ( As per me SAP has changed some policies related with the SAP Router certification).

I'm saying this after confirming the same and found exactly the same result on execution of command "sapgenpse get_my_name -v" which resulted

Issuer  : CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE
Serialno: C2:43:C7:39:93:9B:33:1F:10:01:02:B1:16
KeyInfo : RSA, 2048-bit
Validity  -  NotBefore:   Sat Oct 11 15:41:30 2014 (141011104130Z)
              NotAfter:   Sat Jul 18 15:00:00 2015 (150718100000Z)
----------------------------------------------------------------------------
FCPath certificate level #1:
----------------------------------------------------------------------------
Subject : CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE
Issuer  : CN=SMP Root CA, OU=Service Marketplace, O=SAP, C=DE
Serialno: 12
KeyInfo : RSA, 1024-bit
Validity  -  NotBefore:   Tue Jul 18 15:00:00 2000 (000718100000Z)
              NotAfter:   Sat Jul 18 15:00:00 2015 (150718100000Z)
----------------------------------------------------------------------------
Root Certificate:
----------------------------------------------------------------------------
Subject : CN=SMP Root CA, OU=Service Marketplace, O=SAP, C=DE
Issuer  : CN=SMP Root CA, OU=Service Marketplace, O=SAP, C=DE
Serialno: 10
KeyInfo : RSA, 1024-bit
Validity  -  NotBefore:   Tue Jul 18 15:00:00 2000 (000718100000Z)
              NotAfter:   Fri Jan  1 17:00:00 2038 (380101120000Z)
---------------------------------------------------------------------------

You could see m also getting same expiration dates which you're getting right now.

Hope this will help you as i tried best from my end for searching on it.

Regards,

[Former Member]

Hello Gaurav Rana,

I can´t understand this... I already searched for a solution, for a sap note or something that helps to solve this but I can´t find anything related with this issue!

...

Any tips?

Kind regards,

samid raif

[former_member182657]

Hi Samid,

Generally router cert renews with validity of 1 year,but in your case it's coming with only six months of validity.As per my opinion it could be related with SAP licensing issue for the system.

It would be nice to raise SAP support message for more clarifications on same.

Regards,

Gaurav

[Former Member]

Hello Gaurav Rana,

Thank you for your answer. Yes, but what is strange is this is not the only case that I saw. In other customer I did the same and the new certificate has only 6 months too!

Maybe this situation is related with the expiration date of FCPath certificate level #1 ! What you think about that? Can you tell me what is that (FCPath certificate level...)? As you can see in the image, it has the expiration date of July 18 11:00:00 2015.

Thank you,

samid raif