Do you need new SSL certificates after a homogenious system copy?

[Former Member]

We routinely copy various abap landscapes from prod to Q/A, Sandbox etc. Until recently we were not using SSL so we did not need to worry about SSL certificates, only SSO certificates.

I'm trying to figure out if there is a way to "save" the PSE and replace it after the database is copied.

For example suppose we copy system PRD to QAS.

in strustsso2, QAS had a name of cn=QAS before the copy. Immediately after the system copy, it will be cn=PRD.

If we replace the system name and reset it to cn=QAS, we have to reexport SSO certificates and copy those to other QAS systems like BW, or portal, or at least import their certificates into the QAS system.

Also, we have the SSL certificate of PRD so we have to delete the one for PRD in the just copied QAS system. It seems when you rename the system in strustsso2 your previous ssl certificate response for QAS cannot be imported. Am i ccrrect in thinking that you create a new PSE when you do the replace?

So since you can not import your old certificate response, I request a new SSL certificate, send the request fiile to CA and import a new CA response file. And of course pay for that addiitional certificat.

So the question is, is there an easier way to handle these so we can reuse the old certificates after a system copy?

We have not been copying our java system routinely, but I am thinking they have the same problem if copied.

The abap and java system copied have been NW 701 systems.

Edited by: Fett Patrick on Dec 1, 2011 10:39 PM

[Former Member · Accepted solution]

Hi Fett,

There is a useful OSS Note for this, Please go through it.

1473710 - STRUST: How to Export/Import a PSE from/to STRUST

Let me know if this clears / helps your query.

Regards,

Sriniavs Repala

[Former Member · Accepted solution]

Hi Repala,

Have you tried following that note with success?

Do I save my system PSE, and then also save my SSL Server Standard PSE? And then after system copy, do i do import the system PSE first, then import the Server Standard PSE. It is not clear to me from that note.

How do multiple app servers affect this. Do you have to click on each one and save each one? And then afterwards import each one?

I have a refresh next week so I should be able to test this except that system does not have the added complexity of app servers.

Thanks, Pat

[Former Member · Accepted solution]

HI Fett,

I am using the same procedure since an year now and did several refreshes without any issues.

Regards,

Sriniavs Repala

[Former Member]

I followed note 1473710 - STRUST: How to Export/Import a PSE from/to STRUST

IThe note worked perfectly. A 2 iteration process is needed. First save the system pse, then the ssl pse. After system copy repeate by first recreating system pse per the note, then restore the ssl server pse.

After that all I had to do was fix the ACLs as they are not part of the PSEs.

Thank you

[Former Member]

Hi,

My workaround for this problem is to install a SAP Web Dispatcher on the CI server and to terminate the SSL connection on the web disaptcher. Therefore the SSL certificate is kept after homegeneous system copy.

Regards,

Olivier

[Former Member]

Oliviera,

That is an interesting solution. Would I be correct that on your servers you are using a self signed ssl server standard certificate. So after a system copy you just recreate that. then import that new ssl certificate into your web dispatcher PSE so you do not get a certificate mismatch error?

We have thought about adding a web dispatcher in front of the abap system(s), but they still have a low volume of traffic and we have users hitting the CI for now. Not ideal so we may change that. We are using the Web dispatcher in front of our EP system with SSL termination, but so far we have not be doing system copies of the EP.

[Former Member]

Hello Fett,

There are multiple options available while creating PSE for multiple app servers. Please go through the below link fore more details.

http://help.sap.com/saphelp_nw04s/helpdata/en/20/37c33ae8361838e10000000a11402f/content.htm

Thanks,

Siva Kumar

[Former Member]

Hi Patrick,

My abap servers do have self signed certificates but in fact, it does not matter because the connection between the SAP Web Dispatcher is HTTP and not HTTPS.

After a system copy, we just delete the old SSL server PSE (which are red because they are invalid) and recreate self signed certificates.

I always use a web dispatcher as a http front end even if I don't need load balancing because I can :

Terminate SSL connections,

redirect URLs,

rewrite URLs,

filter IP adresses,

Filter authorised URLs

etc...

The Web dispatcehr is in my opinion a very useful tool !

Regards,

Olivier

[Former Member]

Hello Fett,

You should reconfigure SSL after system copy on target system QAS. You can export PSE before system copy from QAS but it will not work after you import into it after system copy. Same case happened to me as well. So that is the reason I started reconfiguring SSL setup after refresh.

Thanks,

Siva Kumar

[Former Member]

Kumar,

You say you were not able to save the SSL Server Standard PSE successfully. I was wondering how you tried. From note 1473710, I was going to first save the system PSE, then save the SSL server standard PSE. And then after system copy, I would restore the system PSE, then restore the SSL Server standard. Is that what you tried?

I am also wondering how app server instances will affect this. do I need to save the PSE for each instance for example with 5 app servers, do I save 5 x system pse and 5 x ssl server PSE. And then likewise reimport the same number of times.

[Former Member]

Hello Fett,

I did not say that I was not able to save PSE successfully. I said I was able to export before system copy and import the same after system copy but SSL connection did not work. I have also followed the note 1473710.

Since it did not work to me, I had to reconfigure SSL after system copy.

Thanks,

Siva Kumar