Configuring SSL Encryption Between SAP ABAP Application Servers and SAP HANA

[[{“value”:”

Introduction

This blog documents the steps required to configure SSL/TLS encryption between SAP ABAP application servers and an SAP HANA database, using a certificate signed by an external Certificate Authority (CA). This is a common requirement in enterprise migrations and security hardening projects where the default SAP-generated certificates are replaced with organisation-specific ones.

The configuration covered here implements TLS — the HANA database server authenticates itself to the ABAP application layer. sapcli.pse on each ABAP node serves as the trust store, allowing the ABAP kernel to verify HANA’s certificate during the TLS handshake. This guide assumes you are working on a Linux-based SAP system with SAP CommonCryptoLib installed.

Prerequisites

• Database certificate (.pfx format) signed by an external CA, plus the corresponding root certificate
• Certificate password
• Access to the HANA database server at OS level (sidadm or equivalent)
• Access to all ABAP application server nodes at OS level
• A valid HANA userstore key configured for hdbsql commands
• Planned downtime or maintenance window — the ABAP application must be stopped during parts of this procedure
• Existing SAPSSLS.pse backed up before making any changes

Overview

The procedure creates two sets of PSE (Personal Security Environment) files:

1. SAPSSLS.pse on the HANA server — the HANA database server’s SSL identity, built from the externally signed certificate. This is what HANA presents to the ABAP layer during the TLS handshake.

2. sapcli.pse and sapsrv.pse on each ABAP application server — these are placed in the sec directory of each ABAP node. They act as the trust store on the ABAP side, containing the CA certificate chain that the ABAP kernel uses to verify HANA’s certificate. The sslKeyStore reference in the profile parameter also points to sapcli.pse, but since sslclientpki is off on HANA, the client certificate is never requested.

Step 1 — Upload Certificates to the HANA Server

1. Log on to the HANA database server at OS level as sidadm
2. Upload the database certificate (db_cert.pfx), the root certificate (root.cer) (and any intermediate certificates) to the sec directory on the HANA server:

/usr/sap/<SID>/SYS/global/security/rsecssls/

Note: The exact sec directory path may vary. Confirm the location using the SECUDIR environment variable.

1. Before making any changes, back up the existing SAPSSLS.pse:

cp SAPSSLS.pse SAPSSLS.pse.bak

Step 2 — Create SAPSSLS.pse on the HANA Server

Run the following command to create a new SAPSSLS.pse from the externally signed certificate. This becomes the HANA server’s SSL identity:

sapgenpse import_p12 -r root.cer -p SAPSSLS.pse <db_cert.pfx>

• Enter the certificate password when prompted
• When asked for a PIN, you have the option to set one or leave it empty. From a security perspective, setting a PIN is recommended as it adds an additional layer of protection to the PSE file. If a PIN is set, ensure it is stored securely as it will be required for any future PSE operations

SAPSSLS.pse should now be created successfully.

Step 3 — Create the Client PSE Files for ABAP Application Servers

sapcli.pse and sapsrv.pse can be created directly from SAPSSLS.pse:

cp SAPSSLS.pse sapcli.pse
cp SAPSSLS.pse sapsrv.pse

Copy both files to the sec directory on every ABAP application server node (CS/CI and all additional application servers):

/usr/sap/<SID>/<instance_dir>/sec/

Step 4 — Disable sslclientpki on HANA

Important: Shut down the ABAP application layer before executing this step.

This parameter controls whether HANA enforces client PKI certificate authentication. Setting it to off enables one-way TLS (server authentication only), which is the configuration used here.

Run the following hdbsql command from the HANA server:

hdbsql -U <USERSTORE_KEY> "ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('communication', 'sslclientpki') = 'off' WITH RECONFIGURE;"

The WITH RECONFIGURE clause applies the change immediately without requiring a HANA restart.

PRD Systems: This parameter must also be disabled on the secondary/DR HANA node. This can be done via SAP HANA Studio — apply the change on both the primary and DR secondary database nodes.

Step 5 — Configure the ABAP Default Profile

The dbs/hdb/connect_property parameter must be added to the ABAP default profile (DEFAULT.PFL) to instruct the ABAP kernel to use SSL when connecting to HANA. This parameter applies to all application server instances.

Add the following parameter (adapt values to your system):

dbs/hdb/connect_property = ENCRYPT=TRUE,sslCryptoProvider=commoncrypto,sslKeyStore=/usr/sap/<SID>/<instance_dir>/sec/sapcli.pse,sslTrustStore=/usr/sap/<SID>/<instance_dir>/sec/sapcli.pse,sslHostNameInCertificate=<hana_hostname>.<yourdomain.com>

Key values to adapt:

• <SID> — your system ID
• <instance_dir> — the instance directory of each application server (e.g. D00, D01)
• <hana_hostname>.<yourdomain.com> — the fully qualified hostname as it appears in the HANA certificate’s CN/SAN field

Note: The sslHostNameInCertificate value must match exactly what is embedded in the HANA server certificate, otherwise the SSL handshake will fail.

Step 6 — Restart the Application and Validate

Start the ABAP application layer. Once all instances are up, perform the following validation steps.

Validation 1 — Check encrypted connections via SQL

Log on to the system and navigate to transaction DB02 → SQL Editor. Run the following statement, replacing <SCHEMA> with the correct database schema name:

SELECT IS_ENCRYPTED, SSL_VERSION, CLIENT_HOST
FROM SYS.M_CONNECTIONS
WHERE USER_NAME = '<SCHEMA>'
AND IS_ENCRYPTED = 'TRUE';

All active connections for the schema should return TRUE in the IS_ENCRYPTED column. If any sessions return FALSE, review the profile parameter and PSE file placement.

Validation 2 — R3trans connectivity check

Run the following from the OS level on each application server to confirm no transport-layer issues:

R3trans -d

Review the trans.log output — a clean run with no errors confirms successful connectivity between the ABAP application layer and HANA over SSL.

Summary

At this point, SSL encryption between the SAP ABAP application servers and SAP HANA is active using an externally signed CA certificate. The HANA server authenticates to the application layer via SAPSSLS.pse, while each ABAP node uses sapcli.pse and sapsrv.pse as its trust store for verifying HANA’s identity.

This guide was produced by the IT Planning and Software Logistics team, SAP Ireland, based on field experience from enterprise RISE migration projects.

“}]] 

 [[{“value”:”IntroductionThis blog documents the steps required to configure SSL/TLS encryption between SAP ABAP application servers and an SAP HANA database, using a certificate signed by an external Certificate Authority (CA). This is a common requirement in enterprise migrations and security hardening projects where the default SAP-generated certificates are replaced with organisation-specific ones.The configuration covered here implements TLS — the HANA database server authenticates itself to the ABAP application layer. sapcli.pse on each ABAP node serves as the trust store, allowing the ABAP kernel to verify HANA’s certificate during the TLS handshake. This guide assumes you are working on a Linux-based SAP system with SAP CommonCryptoLib installed.PrerequisitesDatabase certificate (.pfx format) signed by an external CA, plus the corresponding root certificateCertificate passwordAccess to the HANA database server at OS level (sidadm or equivalent)Access to all ABAP application server nodes at OS levelA valid HANA userstore key configured for hdbsql commandsPlanned downtime or maintenance window — the ABAP application must be stopped during parts of this procedureExisting SAPSSLS.pse backed up before making any changesOverviewThe procedure creates two sets of PSE (Personal Security Environment) files:SAPSSLS.pse on the HANA server — the HANA database server’s SSL identity, built from the externally signed certificate. This is what HANA presents to the ABAP layer during the TLS handshake.sapcli.pse and sapsrv.pse on each ABAP application server — these are placed in the sec directory of each ABAP node. They act as the trust store on the ABAP side, containing the CA certificate chain that the ABAP kernel uses to verify HANA’s certificate. The sslKeyStore reference in the profile parameter also points to sapcli.pse, but since sslclientpki is off on HANA, the client certificate is never requested.Step 1 — Upload Certificates to the HANA ServerLog on to the HANA database server at OS level as sidadmUpload the database certificate (db_cert.pfx), the root certificate (root.cer) (and any intermediate certificates) to the sec directory on the HANA server:/usr/sap/<SID>/SYS/global/security/rsecssls/Note: The exact sec directory path may vary. Confirm the location using the SECUDIR environment variable.Before making any changes, back up the existing SAPSSLS.pse:cp SAPSSLS.pse SAPSSLS.pse.bakStep 2 — Create SAPSSLS.pse on the HANA ServerRun the following command to create a new SAPSSLS.pse from the externally signed certificate. This becomes the HANA server’s SSL identity:sapgenpse import_p12 -r root.cer -p SAPSSLS.pse <db_cert.pfx>Enter the certificate password when promptedWhen asked for a PIN, you have the option to set one or leave it empty. From a security perspective, setting a PIN is recommended as it adds an additional layer of protection to the PSE file. If a PIN is set, ensure it is stored securely as it will be required for any future PSE operationsSAPSSLS.pse should now be created successfully.Step 3 — Create the Client PSE Files for ABAP Application Serverssapcli.pse and sapsrv.pse can be created directly from SAPSSLS.pse:cp SAPSSLS.pse sapcli.pse
cp SAPSSLS.pse sapsrv.pseCopy both files to the sec directory on every ABAP application server node (CS/CI and all additional application servers):/usr/sap/<SID>/<instance_dir>/sec/Step 4 — Disable sslclientpki on HANAImportant: Shut down the ABAP application layer before executing this step.This parameter controls whether HANA enforces client PKI certificate authentication. Setting it to off enables one-way TLS (server authentication only), which is the configuration used here.Run the following hdbsql command from the HANA server:hdbsql -U <USERSTORE_KEY> “ALTER SYSTEM ALTER CONFIGURATION (‘global.ini’, ‘SYSTEM’) SET (‘communication’, ‘sslclientpki’) = ‘off’ WITH RECONFIGURE;”The WITH RECONFIGURE clause applies the change immediately without requiring a HANA restart.PRD Systems: This parameter must also be disabled on the secondary/DR HANA node. This can be done via SAP HANA Studio — apply the change on both the primary and DR secondary database nodes.Step 5 — Configure the ABAP Default ProfileThe dbs/hdb/connect_property parameter must be added to the ABAP default profile (DEFAULT.PFL) to instruct the ABAP kernel to use SSL when connecting to HANA. This parameter applies to all application server instances.Add the following parameter (adapt values to your system):dbs/hdb/connect_property = ENCRYPT=TRUE,sslCryptoProvider=commoncrypto,sslKeyStore=/usr/sap/<SID>/<instance_dir>/sec/sapcli.pse,sslTrustStore=/usr/sap/<SID>/<instance_dir>/sec/sapcli.pse,sslHostNameInCertificate=<hana_hostname>.<yourdomain.com>Key values to adapt:<SID> — your system ID<instance_dir> — the instance directory of each application server (e.g. D00, D01)<hana_hostname>.<yourdomain.com> — the fully qualified hostname as it appears in the HANA certificate’s CN/SAN fieldNote: The sslHostNameInCertificate value must match exactly what is embedded in the HANA server certificate, otherwise the SSL handshake will fail.Step 6 — Restart the Application and ValidateStart the ABAP application layer. Once all instances are up, perform the following validation steps.Validation 1 — Check encrypted connections via SQLLog on to the system and navigate to transaction DB02 → SQL Editor. Run the following statement, replacing <SCHEMA> with the correct database schema name:SELECT IS_ENCRYPTED, SSL_VERSION, CLIENT_HOST
FROM SYS.M_CONNECTIONS
WHERE USER_NAME = ‘<SCHEMA>’
AND IS_ENCRYPTED = ‘TRUE’;All active connections for the schema should return TRUE in the IS_ENCRYPTED column. If any sessions return FALSE, review the profile parameter and PSE file placement.Validation 2 — R3trans connectivity checkRun the following from the OS level on each application server to confirm no transport-layer issues:R3trans -dReview the trans.log output — a clean run with no errors confirms successful connectivity between the ABAP application layer and HANA over SSL.SummaryAt this point, SSL encryption between the SAP ABAP application servers and SAP HANA is active using an externally signed CA certificate. The HANA server authenticates to the application layer via SAPSSLS.pse, while each ABAP node uses sapcli.pse and sapsrv.pse as its trust store for verifying HANA’s identity.This guide was produced by the IT Planning and Software Logistics team, SAP Ireland, based on field experience from enterprise RISE migration projects.”}]] Read More Technology Blog Posts by SAP articles 

#SAPCHANNEL