Many of you might know this already, just wanted to share in
case any of you doesn’t know this. During refresh of ABAP system, we do have to
delete and recreate all strust certificates (system, ssl, nfe, snc etc) as part
of post refresh steps. Here is a small tip for that; we can take backup of all
folders in Strust. Below is the procedure for the same.
NOTE: Please read the full description of the procedure before
executing.
Export a PSE from STRUST
- Select the PSE to be exported by
double-clicking
Attention when working on the PSE "SSL server Standard": this
PSE typically is a collective PSE, consisting of the default SSL Server
PSE (selected when doubleclicking the SSL Server PSE node in the
navigation tree on the left hand side) and the application server specific
PSEs (selected when doubleclicking the application server entries visible
when opening the SSL Server PSE node)
- Verify, that the PSE to be exported is
displayed on the right hand side of transaction STRUST
- Execute the menu item "PSE --> Save
as..."
- From the appearing popup, select the entry
"File (Export PSE)"
- Select a distinctive file name to save your
PSE file on your local workstation (PC)(*)
- Press the green tick mark button (Input) or
the "Enter" key
Import a simple PSE into STRUST
Keep in mind, that the PSEs you overwrite need to
be backed up first if you plan to reuse them!
- Doubleclick the icon "File" from the
navigation tree on the left hand side of transaction STRUST (**)
- Select the PSE file to be imported from your
local workstation (PC) and open it (*)
- Verify, that the PSE to be imported is
displayed on the right hand side of transaction STRUST
- Execute the menu item "PSE --> Save
as..."
- From the appearing popup, select the entry
representing the PSE type that you want to replace in your system:
For SSL Client PSEs, select the actual client identity to be replaced.
For WSS PSEs, select the actual PSE to be replaced. (not available in all
releases)
For SSF application PSEs, select the actual SSF application to be
replaced.
For SSL Server identities different from 'DFAULT', select the respective
server identity. (not available in all releases)
The procedure for the PSE "SSL server Standard" (DFAULT) is
described below
- Press the green tick mark button (Input) or
the "Enter" key
- Save the PSE by clicking the "Save"
button (diskette symbol)
Import the PSE "SSL Server Standard" into
STRUST
Keep in mind, that the PSEs you overwrite need to be backed up first if
you plan to reuse them!
The PSE "SSL server Standard"
typically consists of multiple simple PSEs, which in the following are referred
to as 'SSL Server PSE'.
The full import procedure consists of three parts, which are shown
seperately for improved readability.
Preparation 1: Investigate the PSEs' SubjectNames
- Make sure, that you have available all SSL
Server PSEs that you want to import
- Open notepad or another editor of your choice
- Repeat the following steps (4..8) for each SSL
Server PSE to be imported:
- Doubleclick the icon "File" from the
navigation tree on the left hand side of transaction STRUST
- Select the PSE file to be imported from your
workstation (PC) and open it (*)
- From the right hand side, copy the
Distinguished Name (DN) of the PSE's own certificate
- Paste the DN into your open notepad, using new
lines for the DN of each SSL Server PSE
- Keep track, which DN refers to which PSE
(default, application server specific)
Preparation
2: Create a "dummy" PSE with the required SubjectNames
Attention - during these steps, an existing "SSL Server PSE"
will be replaced.
- Click the node "SSL server Standard"
with the right mouse button
- Select "Replace" and confirm that
you want to replace the current PSE with a new one
- In the popup appearing, click the
"pen" button (Revise DN)
- Replace the proposed DN with the DN of the
default SSL Server PSE (from the notepad)
If you have no default SSL Server PSE to import, the system proposed DN
will be OK.
- Press the green tick mark button (Input) or
the "Enter" key
- In the second popup, replace the DNs of the
application server specific PSEs with the respective DNs from your
notepad.
- Assure, that you enter the correct DN to the
respective application server.
- Press the green tick mark button (Input) or
the "Enter" key
Processing: The actual import
- Repeat the following steps (2..7) for each SSL
Server PSE to be imported:
- Doubleclick the icon "File" from the
navigation tree on the left hand side of transaction STRUST (**)
- Select the PSE file to be imported from your
workstation (PC) and open it (*)
- Execute the menu item "PSE --> Save
as..."
- From the appearing popup, select the entry
"SSL Server PSE" (DFAULT)
- Press the green tick mark button (Input) or
the "Enter" key
- Confirm, that you want to replace the PSE of
the same DN
- Save the PSE by clicking the "Save"
button (diskette symbol)
Remarks:
(*) Export and Import for the time being is only available to/from your
client workstation (PC).
(**) At this step, don't use the menu item "PSE --> Import"
for opening the PSE to be imported. This would lead to importing the wrong PSE
in the following steps.