TLS 1.2 Support For ECC 6.0

[Former Member]

Hello All ,

We have a situation where we have to Establish connection from SAP To External web services running on Protocol HTTPs and TLS V 1.2.

I have went through the note http://service.sap.com/sap/support/notes/510007       and established all the configuration as need and we are able to connect to that web service on HTTPs and TLS V 1.2. where SAP machines are running on EHP5 and above.

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

But we have one of our major system running on ECC 6.0 Kernel 700 , according to this note http://service.sap.com/sap/support/notes/1848999 we cannot upgrade Crypto lib to common Crypto lib to support TLS 1.2 because it supports only kernel 7.20 PL88 and above.

Important

You must not use CommonCryptoLib if you are running Kernel releases prior to 7.20 PL88, as CommonCryptoLib is not fully compatible with such old releases. Use SAPCRYPTOLIB 5.5 PL38 in such cases.

But i have to use TLS 1.2 even in lower version of ECC running , because out vendor who serves us that webservice they will not support TLS 1.2 and below due to major security issues.

Please  help me understand how should i able to over come this issues , do i really need to upgrade kernel to 720 will ECC 6.0 support kernel 720.

is there a way where in i can run common crypto lib on kernel 700 version.

How do i know the compatibility issues so that i can understand in which areas that would impact our day to day business.

----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Please help me in moving forward.

Thanks in advance!!

Regards,

Vardhan.

[isaias_freitas · Accepted solution]

Hello,

The kernel 700 is not supported anymore, for quite some time!

The kernel 720 is also not supported anymore.

First you need to upgrade your kernel to the latest patch level of the kernel 721.

After that, you can apply the new cryptolib and continue with your implementation.

• SAP note 1716826 - Usage of the downward compatible kernel 721 (EXT)
• SAP note 1713986 - Installation of kernel 721 (EXT)

[Former Member · Accepted solution]

Hello Isaias,

Thank a lot for your reply .

Yeah we are in a plan to upgrade our system to latest Enhancement and kernel but it is planed for 4th quarter of this year.

But due to security some reasons webservice partners  they don't want to support TLS 1.2 and below.

Now My kernel is on lower version i cannot upgrade to Common crypto to support TLS 1.2.

Is there any work around for me to implement this common crypto on Kernel  700 , please advice .

Thanks in advance!!

Regards,

Vardhan.

[isaias_freitas · Accepted solution]

Hello,

You do not need to perform a system upgrade.

The kernel 721 is "downward compatible".

You need to upgrade the kernel only.

Regards,

Isaías

[Former Member · Accepted solution]

Hello Isaias,

I went through this note http://service.sap.com/sap/support/notes/1636252. Kernel 720 has dependency on OS and also Database.

IBM DB2 LUW

IBM DB2/UDB 8 is not supported with the SAP Kernel 7.20.

Which mean i cannot update Kernel on my platform.

Thanks,

Vardhan.

[manumohandas82 · Accepted solution]

Hi Vardhan ,

You are running a SAP system with the database and Kernel level not supported  .

It will be better served if you  upgrade the database and kernel to the required levels ( DB : 9.7 or above or Kernel 7.21/7.22  )

Even in case you manage to do a work around   ( without doing the above ) , it will be a big risk as any issues  and you raise an SAP / IBM  message you run into the  risk of getting no support until you upgrade (db2 and kernel )

Thanks ,

Manu