Create secure RFC Destinations

LiveCompare supports certificate-based secure RFC Destinations. To configure LiveCompare to support secure RFC connections, follow these steps. These steps assume that your SAP server has been configured to support secure connections. You may need to check this with your SAP BASIS Administrator. We recommend that SAPGUI is installed on your LiveCompare server.

Please also see the Configure a secure network connection using certificates topic, which discusses the use of a trusted root certificate and LiveCompare server certificate to create secure RFC Destinations.

Download the SAPCRYPTOLIB library

The following SAP connection components are required.

• The SAPCRYPTO.DLL component manages secure RFC connections within LiveCompare.
• The SAPGENPSE.EXE program creates and manages the certificates used to establish secure RFC connections.

These components are available in the SAPCRYPTOLIB library, which may be downloaded from the SAP Service Marketplace.

1. Access the SAP Service Marketplace at https://support.sap.com/swdc.

2. Select the ‘Software Downloads’ tile. The following screen is displayed.

3. Sign in using your SAP Service Marketplace username and password. The following screen is displayed.

4. Expand the By Category folder and select SAP Cryptographic Software. The following screen is displayed.

5. Select SAPCRYPTOLIB, and then the latest version of COMMONCRYPTOLIB. The following screen is displayed.

6. Select WINDOWS ON X64 64BIT from the dropdown list.

7. Download the .SAR file with the latest patch level to a temporary directory on your LiveCompare server.
8. In the Software Downloads screen, search for SAPCAR. The following screen is displayed.

9. Select the latest SAPCAR release, and select WINDOWS ON X64 64BIT from the dropdown list. The following screen is displayed.

10. Download the .EXE file with the latest patch level to the temporary directory. Save the file as sapcar.exe.

Install the SAPCRYPTOLIB components

To install the SAPCRYPTOLIB components on your LiveCompare server, follow these steps.

1. Open a command window on the LiveCompare server and navigate to the temporary directory. Then run the following.

sapcar.exe -xvf <SAR filename>

2. Run the following to create a directory structure in which to store the components.

cd \

mkdir snc

mkdir snc\bin

mkdir snc\sec

3. Copy the sapgenpse.* files from the temporary directory to the \snc\bin directory.
4. Copy the sapcrypto.* files from the temporary directory to the \snc\sec and \snc\bin directories.
5. Set a system-wide environment variable named SECUDIR to point to the \snc\sec directory.

6. Restart the Tricentis LiveCompare Application Server service, first checking that no users are currently signed in to LiveCompare, and that no workflows are currently running.

7. Sign in to LiveCompare as a user with LiveCompare Administrator permissions, and select the Administration > Configuration > Security folder.

8. In the Configuration - Security screen, set the SncLib field to the following, and click Save.

C:\snc\sec\sapcrypto.dll

Create a PSE file on the LiveCompare server

To create a PSE file on the LiveCompare server, follow these steps.

Note: These steps involve the use of the LiveCompare service account. Changing this account name will invalidate any existing RFC Destinations that use a secure network connection. In this case, you will need to recreate each of your PSE files as described below and then continue with the steps in each of the following sections.

1. Run the following from a command window:

cd \snc

bin\sapgenpse gen_pse -v -p <hostname of LiveCompare server>.pse

2. Enter a passphrase when prompted, and enter CN=<hostname of LiveCompare server> at the Distinguished Name of PSE owner: prompt.

C:\snc>bin\sapgenpse gen_pse -v -p gandalf.pse

Got absolute PSE path "c:\snc\sec\gandalf.pse".

Please enter PSE PIN/Passphrase: *************

Please reenter PSE PIN/Passphrase: *************

get_pse: Distinguished name of PSE owner: CN=GANDALF

Supplied distinguished name: "CN=GANDALF"

Creating PSE with format v2 (default)

succeeded.

certificate creation... ok

PSE update... ok

PKRoot... ok

Generating certificate request... ok.

Certificate Request

Signed Part

Subject :CN=GANDALF

Key

Key type :rsaEncryption (1.2.840.113549.1.1.1)

Key size :2048

Attributes

Signature

Signature algorithm :sha256WithRsaEncryption (1.2.840.113549.1.1.11)

Signature (size="2048") :<Not displayed>

PKCS#10 certificate request for "c:\snc\sec\gandalf.pse":

-----BEGIN CERTIFICATE REQUEST-----

MIICVzCCAT8CAQAwEjEQMA4GA1UEAxMHR0FOREFMRjCCASIwDQYJKoZIhvcNAQEB

BQADggEPADCCAQoCggEBAJdn5eUTAqu9enzTt1eQiSVEguT01KMaaQqlaOWasxeY

qVfpNprD0zHrM6iFSojxA1xYinQ8hf0CLoXUJnNiEbDmpOAPAPoyfnZnfmPeuYhH

FiVxFd671m1dPzQgVqcJq/SwvACFESNCLSVNlou6xLsgC+Ve3okfeJ1jvM/+eRAV

1z1UDOiwvntA2jUbghRH6eKYQwRhOGS709RiSAK31XYw/t6dg3uLrQV9fbLeLLS8

t8oNMaaoj6vqAW3tgc0H0hbR9IFsJGbekyf1m/6N9WDh8erV7IRXwOy9hsdMtYtU

JQIHqwOIfLKgRq0ZBUoLNCxk+mGFO4LVsPTsyz4rzT0CAwEAAaAAMA0GCSqGSIb3

DQEBCwUAA4IBAQAqQodr3gUWx3qdCfn7FozIgLCK4Lf0uotdsJ2QkwBmb+dhc0IE

Tjg3N5PwuUiFC3XLOM+Tvg5Rd0XuoIYtGAWuF+9OoyM6UCv6LjgjuuDgY/PnsMXP

3WcGk3z1gMjTpwFHk9Tui6vEQswuL7EmYa4nOir82QTg7qTyfSqEP6ho+E4Rg/XS

AjYfEO7KRZBD7RDBmIBxuGjGZ/+6GpNxhKytJExNM5qqlG6VUiI0T+UVdxrKe3L5

I9MtOj8hdQAh82S+ZltOfbf+Pq/LprKIa3q8uye8XIYaRoLCwdAUi7cI5JIev/FP

bAVf9bJBofVYA7Zm+WX+4nYqfR7ChnpAuBQ9

-----END CERTIFICATE REQUEST-----

3. Run the following to update the PSE file with details of the account that runs rnserver.exe as a service.

C:\snc>bin\sapgenpse seclogin -p gandalf.pse -O gandalf\livecompare

running seclogin with USER="hhunter"

creating credentials for user "gandalf\livecompare" ...

Please enter PSE PIN/Passphrase: *************

Adjusting credentials and PSE ACLs to include "gandalf\livecompare"...

c:\snc\sec\cred_v2 ... ok.

c:\snc\sec\gandalf.pse ... ok.

Added SSO-credentials for PSE "c:\snc\sec\gandalf.pse"

4. Run the following to extract the certificate from the PSE file.

C:\snc>bin\sapgenpse export_own_cert -v -p gandalf.pse -o gandalf.crt

Opening PSE "c:\snc\sec\gandalf.pse"...

No SSO credentials found for this PSE.

Please enter PSE PIN/Passphrase: *************

PSE (v2) open ok.

Retrieving my certificate... ok.

Writing to file (PEM-framed base64-encoded)... ok.

Install the certificate in SAP

To install the certificate in SAP, follow these steps on your LiveCompare server.

1. Start SAPGUI and sign in to the SAP system on which the certificate is to be installed.

2. Run transaction STRUST and expand the SNC SAPCryptolib folder.

3. Double-click the object corresponding to your SAP server in the SNC SAPCryptolib hierarchy folder. The following dialog is displayed.

4. Enter your SNC SAPCryptolib password, and click . The screen changes to the following, showing any certificates that have already been installed.

5. Click to switch the screen into Change mode.
6. Click (Import Certificate). The following dialog is displayed.

7. In the File path field, browse for the <hostname of LiveCompare server>.crt file that you exported from the PSE file.

8. Click to return to the Trust Manager screen.

9. Click Add to Certificate List. Confirm that the certificate is in the Certificate List, then click .

Add the SAP certificate to the LiveCompare PSE file

To add the SAP certificate to the LiveCompare PSE file, follow these steps.

1. In the Own Certificate section, double-click the Subject field to select the SAP server’s own certificate.

2. Click (Export Certificate). The following dialog is displayed.

3. Set the file path field to C:\snc\<hostname of SAP server>.crt, and select Base64 in the File format section.

4. Click to export the certificate.
5. Run the following from a command window to add the SAP certificate to the LiveCompare PSE file.

C:\snc>bin\sapgenpse maintain_pk -v -a sap43.crt -p gandalf.pse

Opening PSE "c:\snc\sec\gandalf.pse"...

No SSO credentials found for this PSE.

Please enter PSE PIN/Passphrase: *************

PSE (v2) open ok.

retrieving PKList

Adding new certificate from file "sap43.crt"

----------

Subject : CN=SAPServiceS43@TRICENTIS.COM

Issuer : CN=SAPServiceS43@TRICENTIS.COM

Serialno : 0A:20:16:05:26:09:15:01

KeyInfo : RSA, 2048-bit

Validity - NotBefore: Thu May 26 09:15:01 2016 (160526091501Z)

NotAfter: Fri Jan 1 00:00:01 2038 (380101000001Z)

KeyUsage : none

ExtKeyUsage : none

SubjectAltName : none

----------------------------------------------------------------------------

PKList updated (1 entries total, 1 newly added)

Update SAP views

Return to SAPGUI and follow these steps to update the VSNCSYSACL and VUSREXTID views on the SAP server where the certificate has been installed.

1. Run transaction SM30.

2. Enter VSNCSYSACL in the Table/View field, click Maintain, and dismiss the warning about the table being cross-client. The following dialog is displayed.

3. Enter E in the Type of ACL entry field, and click to open the view.

4. Click New Entries The following screen is displayed.

5. Complete the screen fields as follows:

Field	Description
System ID	The hostname of your LiveCompare server.
SNC Name	Enter p:CN=<hostname of LiveCompare server>.

Select the Entry for certificate activated and Entry for ext. ID activated checkboxes. The screen should look like this:

Note that selecting the Entry for ext. ID activated checkbox allows secure RFC Destinations to be created in LiveCompare without using a certificate; only an SAP username and password is required.

6. Save the new entry and return to the previous screen. Confirm that the entry is listed and save your changes.

7. Run transaction SM30 and maintain the VUSREXTID view. The following dialog is displayed.

8. Enter DN in the External ID type field, and click to open the view.

9. Click New Entries The following screen is displayed.

10. Click the button to the right of the External ID field, and browse for the LiveCompare machine’s certificate file.

11. Complete the remaining screen fields as follows:

Field	Description
User	Browse for an SAP user account to be associated with the External ID.

12. Select the Activated checkbox. The screen should look like this:

13. Save the entry and return to the Change View “Assignment of External ID to Users”: Overview screen.

Create a secure RFC Destination in LiveCompare

To create a LiveCompare RFC Destination that uses the secure connection, follow these steps.

1. Sign in to LiveCompare as a user with sufficient permissions to create RFC Destinations.
2. Select the Administration > RFC Destinations hierarchy folder and choose New RFC Destination… from the context menu.

3. Enter a name and description for the RFC Destination, and select ‘Custom Application Server’ from the Connection Type field. Complete the remaining screen fields as follows:

Field	Description
Application Server	The DNS name, domain name, or IP address of the SAP Application Server. If the connection requires an SAP router string, include the SAP router string in this field.
Instance Number	The application instance number of the SAP system to be used for the connection.
Client	The SAP client number to be used for the connection.
Language	The SAP code for the logon language (for example, EN for English).
Username	The SAP user ID to be used for the connection.
Password	The SAP password for the user ID specified above. Passwords for SAP kernel releases earlier than 700 should be specified in upper case.
My Name	Enter a connection string that refers to the LiveCompare server. For example, p:CN=GANDALF.
Partner Name	Enter a connection string that refers to the SAP server. For example, p:CN=SAPServiceS43@TRICENTIS.COM.
Qop	Select the Quality of Protection level used for the connection. For example, 8 - Apply Default Protection.
X.509 Certificate (optional)	Open the <hostname of SAP server>.crt certificate file using Notepad. Enter Ctrl+A and then Ctrl+C to copy the contents of the file to the Windows Clipboard. Paste the contents into the X.509 Certificate field. Note that the BEGIN CERTIFICATE and END CERTIFICATE lines are removed automatically. If the Entry for ext. ID activated checkbox was selected here, a secure RFC Destination may be created LiveCompare without using a certificate. In this case, the Username, Password, My Name and Partner Name fields must be completed.

4. Click Add RFC Destination to add the RFC Destination.

Test the connection

To test the connection, select the RFC Destination in the LiveCompare hierarchy and choose Test Connection from the context menu. If the connection test was successful, a screen similar to the following will be displayed.

Related topics

Create RFC Destinations

Configure a secure network connection using certificates