Use trusted certificates to configure a secure network connection

A secure network connection (SNC) between a LiveCompare server and an SAP system can use certificates to establish trust. The approach described here adds a trusted root Certificate Authority (CA) to the SAP system, and uses a LiveCompare server certificate that derives from the same root. Because the SAP system trusts the root CA, it trusts the LiveCompare server certificate automatically.

You don't need to import the LiveCompare server certificate into each SAP system individually. That's a small saving when you have one SAP system, but a significant one when you have tens or hundreds. You can also create secure RFC Destinations by importing each LiveCompare server certificate directly into each SAP system, without using a shared root CA.

The following sections explain how to set up an SNC in LiveCompare with trusted certificates, from preparing the LiveCompare server to testing the connection.

Before you start

You'll need the following:

  • A LiveCompare server certificate.

  • A root CA.

  • Access to the SAP systems you want to use for an SNC.

  • Administrator access on the LiveCompare server.

LiveCompare server tasks

Follow these steps on your LiveCompare server.

Prepare the LiveCompare server

To prepare the LiveCompare server, follow these steps:

  1. Download the SAPCRYPTOLIB library.

  2. Install the SAPCRYPTOLIB components.

Export the certificates

To export the certificates you need, follow these steps:

  1. On the LiveCompare server, run Certificate Manager (certim.msc).

  2. Export the LiveCompare server certificate, including the private key, to a .pfx file.

  3. Use the certification path of the LiveCompare server certificate to go to the root CA.

  4. Export the root CA and any intermediate certificates to a .cer file.

Create a Personal Security Environment (PSE) file

To create a PSE file and import the root CA, follow these steps on the LiveCompare server:

  1. Open a command prompt. Then, verify that the SECUDIR environment variable points to C:\SNC\SEC and that the PATH environment variable includes C:\SNC\BIN.

  2. Run the following command:

    sapgenpse import_p12 -r <root CA .cer file> -p <LiveCompare server certificate .pse file> <.pfx file name>

Example: sapgenpse import_p12 -r root.cer -p lcserver.pse lcserver.mydomain.com.pfx

Verify the PSE file

Optionally, to verify that the command created the PSE file correctly, follow these steps:

  1. Run the following command to export the certificate to a test .crt file:

    sapgenpse export_own_cert -p lcserver.pse -o test.crt

  1. Run Certificate Manager (certim.msc) and examine the certificate.

Allow the LiveCompare service account to access the private key

To allow the LiveCompare service account to access the private key, run the following command on the LiveCompare server:

sapgenpse seclogin -p <.pse file name> -O <LiveCompare server name>\<LiveCompare service account>

Example: sapgenpse seclogin -p lcserver.pse -O lcserver\livecompare

Obtain the value to use in the My Name field

To obtain the value to use in the My Name field when you create the RFC Destination, follow these steps:

  1. Run the following command on the LiveCompare server:

    sapgenpse seclogin -l -O <LiveCompare service account> -p <.pse file name>

    Example: sapgenpse seclogin -l -O livecompare -p lcserver.pse

  1. Find the line that begins with 0 (LPS:OFF):. Copy the text from CN to the end of the line, and paste it into a temporary text file.

SAP system tasks

Follow these steps on your SAP system.

Import the root CA into your SAP system

You don't need to import the LiveCompare server certificate. To import the root CA into your SAP system, follow these steps:

  1. Run transaction STRUST. In the Trust Manager: Display screen, expand the SNC SAPCryptolib folder.

  2. In the SNC SAPCryptolib hierarchy folder, double-click the object that corresponds to your SAP server, and enter your SNC SAPCryptolib password.

  3. Select Display/Change tool button. to enter Change mode.

  4. Select Import Certificate tool button., and import the root CA's .cer file.

  5. Select Add to Certificate List in the Trust Manager: Change screen.

  6. Confirm that the certificate is in the Certificate List, then select Save tool button..

Add a self-signed SAP server certificate to the PSE

Only follow the steps in this section if the SAP server certificate isn't signed by the same trusted root CA. For example, if it's self-signed. If the SAP server certificate derives from the trusted root, the LiveCompare server trusts it already and you can skip to the next section.

To add a self-signed SAP server certificate to the PSE, follow these steps:

  1. In SAP, run transaction STRUST and open your SAP server's own certificate.

  2. Select Display/Change tool button. to enter Change mode.

  3. Select Export certificate tool button. to export the certificate. Select Base64 as the file format, and save the certificate as a .cer file.

  4. Copy the .cer file to the LiveCompare server.

  5. On the LiveCompare server, run the following command to add the SAP server certificate to the PSE:

    sapgenpse maintain_pk -v -a <SAP server certificate .cer file> -p <.pse file name>

    Example: sapgenpse maintain_pk -v -a sapserver.cer -p lcserver.pse

  1. Enter the PSE passphrase when prompted. Confirm that the new certificate appears in the PKList output.

RFC Destination tasks

Follow these steps to create and test an RFC Destination in LiveCompare.

Create an RFC Destination

To create an RFC Destination for the SAP system in LiveCompare, follow these steps:

  1. Sign in as a LiveCompare Administrator.

  2. Select the RFC Destinations tab and select Add button. to display the RFC Destination dialog.

  3. Complete the general fields:

Field What to do
Name Enter a unique name that identifies the RFC Destination.
Description Enter a description for the RFC Destination.

  1. Complete the RFC Parameters as follows.

Field What to do
Connection Type Select Custom Application Server.
SAP Router If your SAP system is behind an SAP router, enter an SAP router string.
Application Server Enter the DNS name, domain name, or IP address of the SAP Application Server.
Instance Number Enter the application instance number of the SAP system to use for the connection.
Client Enter the SAP client number to use for the connection.
Language Enter the SAP code for the logon language (for example, EN for English).
User Enter the SAP user ID to use for the connection.
Password Enter the SAP password for this user ID.

  1. Complete the SNC Parameters as follows.

Field What to do
My Name Paste the text you saved when you obtained the value to use in the My Name field.
Partner Name Enter the partner name to use for the connection, prefixed with p: and ending with ”, for example, p:CN=SAPService<SID>@domain.com”.

  1. Select Save to create the RFC Destination.

Test the RFC Destination

To test the RFC Destination, select its Test icon. icon in the Guided Configuration - RFC Destinations screen. Verify that the connection test is successful.

For additional confirmation that SNC is active, open the dev_rfc.log file in the <LiveCompare user data dir>\public\Logs folder on the LiveCompare server. The log entries for the connection show that SNC is in use.

What's next

To use LiveCompare with additional SAP systems, you'll need to create additional RFC Destinations in either the apps user interface or the studio. Check the following topics: