SAP Web Dispatcher - Load Balancing and SSL

[Former Member]

When using a Web Dispatcher to load balance to multiple R/3 servers, should you create a unique SSL certificate for each R/3 server, or a generic one?

i.e. which of theses scenarios is valid/best?:

https://myurl.mydomain.co.uk = Web Dispatcher

https://myurl.mydomain.co.uk = R/3 server 1

https://myurl.mydomain.co.uk = R/3 server 2

https://myurl.mydomain.co.uk = R/3 server 3

or

https://myurl.mydomain.co.uk = Web Dispatcher

https://myurlA.mydomain.co.uk = R/3 server 1

https://myurlB.mydomain.co.uk = R/3 server 2

https://myurlC.mydomain.co.uk = R/3 server 3

or

https://myurl.mydomain.co.uk = Web Dispatcher

https://myurlA.mydomain.co.uk = R/3 server 1

https://myurlA.mydomain.co.uk = R/3 server 2

https://myurlA.mydomain.co.uk = R/3 server 3

Thanks.

[Former Member · Accepted solution]

Hi,

have you already gone through the Web dispatcher's documentation: <a href="http://help.sap.com/saphelp_nw04/helpdata/en/d8/a922d7f45f11d5996e00508b5d5211/frameset.htm">SAP Web Dispatcher and SSL</a>. Judging by what's in there, it should be a generic certificate.

Hope that helps!

[Former Member · Accepted solution]

I can see how to create individual SSL certificates for each application server, but am not 100% sure how to create a generic one. I am guessing:

Go into transaction STRUSTSSO2

Right click on 'SSL Server'

Delete

Create a new one

Make the PSE = myprefix.mydomain.co.uk, OU=I00123456789, OU=SAP Web AS, O=SAP Trust Community, C=DE

Currently it is as above, but the 'myprefix' is ''. On each application server the '' is replaced with the system name.

My only hesitation in doing this is that documentation I have read tells me to use '*' and I have not seen any documentation detailing how to use a single certificate for multiple application servers... Please note that I do not want to use a single PSE for all application servers.

Thanks.

[jochen_rundholz]

Hi Paul,

which protocol do you use between Web Dispatcher and R/3? I assume SSL as well, are you aware that you don't have to (technically)? From the client to the Web Dispatcher you use SSL, what happens to the SSL inside the Web Dispachter? Termination, forwarding or Reencryption? Depending on what happens at the SAP Web Dispatcher you need to have different setups.

Regards,

Jochen