Multiple alies on one standalone Web Dispatcher instance

[Former Member]

kernel information

-

---

system name =

kernel release = 700

database library =

compiled on = NT 5.0 2195 Service Pack 4 x86 MS VC++ 13.10

compile time = Sep 23 2007 20:34:43

update level = 0

patch number = 128

source id = 0.129

SAPCRYPTO-Library 5.5.5pl21

What I want to do is to be able to connect to this web dispatcher using either https://ayz.x.com and https://abc.x.com for example. Is this possible?

SAP Note 1058307 seems to suggest it is.

[Former Member]

Hi,

Check note

<a href="https://service.sap.com/sap/support/notes/709482">Note 709482 - Virtual hosts and SAP Web Dispatcher</a>

I did it in an other way :

An Apache reverse proxy with several virtual hosts in front of several web dispatchers.

Regards,

Olivier

[Former Member]

Thanks Olivier,

I saw where both IIS 6 and Apache supported this. Is the Apache server where you have the certificates installed? We looked at that note as well. It only covers the HTTP protocol.

I am assuming in your landscape, browser sessions would hit the Apache server via port 443, and then be forwarded to the backend SAP Web Dispatchers using HTTP virtual hosts.

You would think since this SAP Web Dispatcher technology is based upon Apache that it would work. I don't have the option to use Apache in our DMZ so I am stuck installing certificates on the Web Dispatchers.

I thought about trying sapgenpse gen_pse -p SAPSSLS.pse and use two Commanes Names like CN=xyz.x.com, CN=abc.X.com, OU=IT, O=<company>, L=<City>, C=<State>. I think this is called a Unified Communitations Certificate and that is only for Exchange Servers.

[Former Member]

Hello Dan,

In my landscape, The Apache server is installed in the DMZ and acts simultaneously as a forward proxy on one virtual server and as a reverse proxy on an other virtual server.

Only XI has the right to use the forward proxy to access only specific business partners on the Internet.

Every IP address from the internet has the right to connect to the reverse proxy which answers only on HTTPS. The only signed SSL certificate is installed on the reverse proxy virtual host.

Depending from the URL, the reverse proxy directs the traffic :

either to one first web dispatcher connected to an SRM system for web access.

either to a second web dispatcher conencted to XI for Rosettanet business messages.

In fact, I don't use virtual servers with the SAP web dispatcher. The 2 web dispatchers are installed on the same physical machine; thay just listen on 2 different ports. All the connections are HTTPS.

What make you think that the web dispatcher is based upon Apache ?

It is surely based on the same source code as the ICM but the only common point, I see is the log file syntax.

When I reread the OSS note, I understand now that the virtual servers are supposed to be defined on the ICM and not on the web dispatchers.

I don't see how you can install 2 SSL certificates for the same web dispatcher.

Maybe you can install 2 different web dispatchers on you DMZ machine ?

If they absolutely need to answer both on port 443, you could install them in 2 different virtual machines ? (vmware or virtual server).

Best Regards,

Olivier

[Former Member]

Hi Olivier,

Thats exactly what I had to do was configure two Web Dispatchers. I wanted to use one as a High Fail over option and could have installed two instances on one Wintel server. But having two physically on the same box was just too risky. As it is I can still use the other as a fail over with some minor infrastructure changes like DNS etc..

Thanks for the help and information.

Best Regards,

Dan