Using same Wildcard certificate on multiple SAP systems with same domain name.

Hello All,
Need urgent help.
I have a WILDCARD SSL certificate in pfx format. I also have individual root certificate , primary certificate in text form.
The certificate mentioned above is already active in one of our portal.
We want the same certificate on ECC Production.
What are the steps to import this certificate in STRUST?
I believe no certificate response needs to be imported.
I have a certificate response provided by Verisign. But STRUST says- cannot import certificate response'
Please help.

Hi,
This is what i did for installing wildcard certificates:
On the OS of the sap server, log in with the sapadm account.
Open a command prompt:
make a backup of your sec directory in drive:\usr\sap\<SID>DVEBMGS00\ (just to be sure)
cd to drive:\usr\sap\<SID>DVEBMGS00\exe
>sapgenpse.exe import_p12 =p SAPSSLS.PSE location\to\the\certfile.pfx
It will ask you for the pin, and to overwrite the file, answer yes.
Now copy the new SAPSSLS.PSE to a desktop that has sapgui
Login with the sapgui and run transaction strust
Select import from the PSE menu and open the SAPSSLS.PSE
Then again goto PSE menu and select Save As
I saved it twice, once in System PSE and then again in SSL Server
For me SSL is now working without problems on a couple of servers.
-small update-
You can check internal servers using the certificate utility from digicert https://www.digicert.com/util/
It has the option to specify port numbers, usefull for internal web services.
Regards,
Rolf

Similar Messages

Is it possible to install two SAP system with same SID but different instance numbers on one host?

Is it possible to install two SAP system with same system ID (SID) but different instance numbers on one host?
If yes, then how?
If no, then why?
Thanks in advance.
Regards,
Sarim

Is it possible to install two SAP system with same system ID (SID) but different instance numbers on one host?
Yes, it is possible. If one is CI (PAS) and the second one is an AS (AAS). In this case there will be only one database.
If you are talking about two separate SAP systems with separate databases (Eg: A BI and an ECC) with the same SID then the problem will be with the database (Eg: Oracle)
The database will be installed under /oracle/SID/112_64 (ORACLE_HOME) unless one database is running on 10 G and in that case the ORACLE_HOME will be /oracle/SID/102_64
The next issue will be with the SAP file systems like /sapmnt/SID
The most important problem will be with the switch to the sidadm and orasid users and the conflicts there. If there is a need to stop one of the SAP systems and if you do a switch to sidadm and issue a stopsap command which system will be stopped ?
These are few of the many problems I can think of.
So if we are talking about two separate systems with their own databases I would rule out the possibility of having two systems with the same SID.
Regards
RB

Is it possible to use single ssl certificate for multiple server farm with different FQDN?

Hi
We generated the CSR request for versign secure site pro certificate
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;}
SSL Certificate for cn=abc.com considering abc.com as our major domain. now we have servers in this domain like www.abc.com, a.abc.com , b.abc.com etc. we installed the verisign certificate and configured ACE-20 accordingly for ssl-proxy and we will use same certificate gerated for abc.com for all servers like www.abc.com , a.abc.com , b.abc.com etc. Now when we are trying to access https//www..abc.com or https://a.abc.com through mozilla , we are able to access the service but we are getting this message in certfucate status " you are connected to abc.com which is run by unknown "
And the same message when trying to access https://www.abc.com from Google Chrome.
"This is probably not the site you are looking for! You attempted to reach www.abc.com, but instead you actually reached a server identifying itself as abc.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of adgate.kfu.edu.sa. You should not proceed"
so i know as this certficate is for cn=abc.com that is why we are getting such errors/status in ssl certficate.
Now my question is
1. Is is possible to remove above errors doing some ssl configuration on ACE?
2. OR we have to go for VerisgnWildcard Secure Site Pro Certificate for CSR generated uisng cn =abc.com to be installed on ACE and will be used for all servers like www.abc.com , a.abc.com etc..
Thanks
Waliullah

If you want to use the same VIP and port number for multiple FQDNs, then you will need to get a wildcard certificate. Currently, if you enter www.abc.com in your browser, that is what the browser expects to see in the certificate. And right now it won't beause your certificate is for abc.com. You need a wildcard cert that will be for something like *.abc.com.
Hope this helps,
Sean

Multiple SAP Systems with one Unique ID

Hi,
SAP recommend to have <sidadm> and <sapserviceSID> user account for each system.
Currently we create domain users for each SAP System. We are installing many test servers and trying to see if I can avoid creating domain user account for each system and use only one account to administer all test sap systems.
Just wanted to know if there is any way to have one domain SIDADM user id and one domain SAPService user account to run multiple test SAP systems?
Thanks,

Hi,
Multiple test system you have different SID. so you must use different SAPserviceSID user. But you can use one SIDADM user with the proper permission with other test systems.
I have used in OS400 environment with single SIDADM user id.
please check with users with permission sap notes or document.
But SAP not recommanded this.
Thanks and Regards,
Jibin.

Multiple Web Sites with Personal Domain Names - Overview

I have read through the last 10 pages of these discussions and have almost worked this out, but I need some help.
Problem:
I want to publish and edit two separate web sites with their own, individual, personal web addresses
from the same user account on the same Mac using iWeb '08 (2.0.2) and my .Mac account
_So far:_
I have purchased and registered the two domain names (with Cheap-DomainRegistration.com)
I have configured the CNAME to point to web.mac.com, and "Set up a Personal Domain" in iWeb successfully, but using a separate Mac for each web site.
The two sites work great.
_What (I think) I need to know:_
(excuse me for copying these posts out, but I can't find a way to link them to this post)
1) Should I be using iWebSites as suggested by Old Toad (posted Jan 24 in response to StAnNe's "Multiple Websites--HELP!!!")?
I use iWebSites to manage multiple sites.. It lets me create multiple sites and multiple domain files.
2) Should I be using Mireille's approach (also posted Jan 24 in response to StAnNe's "Multiple Websites--HELP!!!")?
Yes you are correct in the thought that with a family pack you can use different accounts and that is the easiest way to upload with one click to .mac. But it is still possible to publish differents sites to one .mac account if that is all one has. Even if the sites are in one domain file each purchased mysite.com domain name purchased can be pointed to a different page in the site
Look at it this way
Original Poster has
site1 page 1 page 2 and so on
then he/she has brothersite page 1 and so on.
They each have a domain name purchase wherever
then site1domain.com is forwarded to site 1 page1
and brotherdomain.com is forwarded to brothersite page 1.
Even though both sites are in the same file they do not have anything to do with each other.
This is one possibility there are others but for a novice user this could be the way to go for simplicity.
(Mireille, if you're there, can you clarify what you said - thank you)
3) Would I use Roddy's fix (posted Jan 23 in response to canadensis' "Publishing Multiple Websites?")?
Here's an example of how you can separate two websites that are on the same domain file.
Quit iWeb
Create a new folder on your desktop and call it "iWeb Sites".
Inside this folder create two more - Website A, Website B.
Go to Home Folder/Library/Application Support/iWeb and copy your domain file - command C
Paste this into folders A and B - command V - and also paste a copy of it somewhere else - like in Docs - in case you make a mistake!
Double click the domain file in the folder Website A - this will launch iWeb.
In the left column, delete site B, save and quit iWeb.
Double click the domain file in the folder Website B to launch iWeb.
Delete website A, save and quit.
Drop the iWeb sites folder into your Home Folder.
If you want quick access to this folder you can highlight it and do command L to create an alias to leave on the desktop.
From now on, to launch any site in iWeb you open its folder in the iWebsites folder and double click the domain file.
This is not necessary when you are working on only one site as iWeb saves the domain file of the last site you were working on to Home Folder/Library/Application Support/iWeb. When you open the iWeb application, the last site you worked on will be launched.
Summary:
I'm not sure if some of the answers in previous discussions allow for personal domain names, which is what I need.
I would be very grateful for any suggestions as I'm getting bogged down.
Many Thanks,
Jeff

When you said, "you don't need to do CNAME for both sites…", would this method still allow me to use personal web addresses for both sites?
Yes. With "Ordinary Forwarding" you normally just type your .Mac url (web.mac.com/username/sitename) into a form at the place where you have your name.
I thought I was using 'web.mac.com' as the 'www' CNAME (alias) for my personal domain name (web address), so that when someone typed in my personal domain name they would 'go' to the domain registration location, which would then pass it on to the .Mac server, where my web site is hosted.
That's exactly right. It's just not the only way to do that. Ordinary Forwarding is another way, but it differs in terms of what appears in the address bar of the browser. Either you will see web.mac.com/username/.... or, if you add "masking", you will see your personal name for all pages. The CNAME method results in a address bar that reads www.myname.com/sitename/pagename.html.
Am I way off?
All help gratefully received,
Jeff

Multiple SAP systems in MSCS with Oracle

Hello,
We are going to install a BI instance in a MSCS cluster in which there is already a SAP system installed and clustered.
The SO is Windows 2008 and Oracle 10.2.0.4.
My problem is about the Oracle sw. In previous SAP releases there was a guide called "Installation of Multiple SAP systems in MSCS: Oracle".
For my release Netweaver 7.0. EHP1 SR1, there is no specific guide. All the references are the installation guide and part related to MSCS installation and a white paper about "new configuration of multiple SAP systems with Windows 2008 Failover Clustering".
In all that documents I haven't found what to do with the database. In the beginning of the installation documents says that Multiple Oracle_home for different database instances are not supported in an MSCS configuration. But in the pages related to the MSCS installation says "if required, set up multiple Oracle Homes".
So, what's the option? Multiple Oracle_homes or MCOD? Be in mind that I already have a SAP system in this cluster, so I already have an Oracle home c:\oracle\<SID>\102
Have you work in this scenario?
Thanks and best regards,
Ana.

Hi,
Officially SAP does not support Multiple SAP Systems in One MCSC Cluster. If such installation & configuration has been done by SAP Global Technology Partner then and then only SAP provide support.
what's the option? Multiple Oracle_homes or MCOD?
GO for multiple oracle_home , in which the same drive letter for oracle_home should be used on local disks in both MCSC cluster nodes. And the same oracle_home should be junctioned to the shared location on shared space.
The Chapter 7 High Availability with Microsoft Cluster Service of [Inst. Guide SAP NetWeaver 7.0 incl. EHP1 SR1|http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000659894&_OBJECT=011000358700000353072009E] contains all the required information with detail. Refer it.
Regards,
Bhavik G. Shroff

Fall back systemwhen multiple SAP systems trying to acheive SSO with BOEXI

Friends,
I need a small clarification on ' SSO between BOE XI 3.1 and SAP BI 7' Scenario,
Say when multiple users log on through their SAP EP Portals or Netwever Portals, they use their tokens generated by their respective EP portals which are passed through the 'Web application server' hosting BOE environment.
1) When its a Single EP portal , we can have have a fall back system. when we register its logical name in the CMC of BOE Environment , a typical SNC.But what's the fall back system for multiple SAP systems?
2) Also Whether there are any pit falls via token method when more than one SAP system communicating to BOE?
3) Do we have any documentation for this?
Thanks ,
Sivakanth.

Hi Sivakanth,
the normal scenario for SSO is the following:
When you said ''back end system ', i did not get it.
Enterprise Portal -
(iView)-------> BOE -
> SAP BI <- This is your backend system
Well Could I define more than one logical name there in SNC tab of CMC.?
I assume you have the following situation:
(EP1, EP2, EP3) -
> BOE -
> (SAP BI 1, SAP BI 2, SAP BI n)
You can define more than one entitlement systems in the BOE CMC and also configure for each one of them for SNC. Please note that we are talking about server trust and NOT client trust here. It is all about letting your sap system and the boe system trust each other. If you have your portal with client SNC configured (ie. the user logs using a certificate and an SAP logon ticket is created) it is NOT necessary to configure SNC in the CMC (Please refer to the section "Configuring SAP Server-Side Trust" in the installation guide for the integration kit for SAP) side.
Back to the SSO scenario now: When a user connects from an enterprise portal on the BOE system the logon ticket, generated from the portal, is forwarded to the back-end system, which is defined in the portal iView the user is currently navigating through. If it is a Crystal Enterprise iView then you just have to select the appropriate system alias of your back-end system in the System drop down menu when creating the iView. For URL iViews you must utilize the relevant openDocument parameters. If you do not define anything at all when creating the iView then BOE tries to authenticate the logon ticket against the SAP BI system you selected to be the default one in the "Authentication->SAP->Options" tab of the CMC.
If what you want is just to distribute the load between your SAP back-end systems then you should consider utilizing an SAP cluster for your pursposes. As explained before BOE will not distribute the requests evenly on the back-end systems. It will try to contact either the system defined in the request (iView) or the default system. To be honest I am not sure what happens if the explicitely defined system is not available but I think that an error message is what you should expect then. I do not think that in this case the BOE system tries to use the system defined as default.
Another part is what kind of security is defined in BEX querys..as i read from SAP IK guide, we can import all the roles which are defined at ABAB level.
Will there be any security threats to SAP data via this method.
It is true that you can import all roles in your BOE system. But keep the following four things in mind:
1) You can restrict on the BOE side the users which are authorized to logon in the CMC and import the roles (normally only the BOE administrator is authorized to do this)
2) Importing a role means that an SAP user can try to logon the BOE. Still the logon process can only be succesfull only if the SAP user has special authorization on the SAP side (Please check the Appendix "Authorizations" in the installation guide of the integration Kit for SAP.
3) You can restrict the access to data by assigning authorizations only for specific infoareas/infoproviders. In order to partially restrict data access in a given infoprovider (e.g infocube or multiprovider) you can utilize authorization variables in your BW query.
4) You can further restrict access on specific reports either on the BOE side or on the portal side (by rstricting access to the defined iViews).
For sure you must invest some time to define and implement your security concept.
More over could you please answer other 2 questions in my original question.
2) Also Whether there are any pit falls via token method when more than one SAP system communicating to BOE?
3) Do we have any documentation for this?
2) As long as your portals, the back-end systems and your BOE system are configured correctly for SSO this should not be a problem. Well just a tip based on my experience: be sure to use full qualified domain names for your systems in the iView definitions. And do not forget SSO works only if all systems are in the same domain.
3) As said in my previous posting the netweaver documentation regadring SSO setup maybe interesting for you. As far as I know the multiple systems scenario is not contained explicitely in any official BOBJ documentation. I assume that you already went through the installation guide for the integration kit for SAP.
Please tell me if you have a completely different scenario in mind
Regards,
Stratos
Edited by: Efstratios Karaivazoglou on Mar 22, 2009 12:27 AM

Multiple SAP Systems In One MSCS Cluster

We have installed a NW 7.0 EHP abap stack in a MSCS Cluster with 2 nodes.
This was installed as a standard Cluster Install.
We have now higlighted a requirement to install a 2nd (Java ) instance in this Cluster Group.
The NW 7.0 EHP1 documentation and Note 1321854 shows that multiple SAP systems in one MSCS cluster is supported.
The documentation, however, is not clear if the 2nd instance can be installed when the 1st instance was installed without the preperations for Multiple Systems.
There are no further documentation or guidelines to help.
Has anyone come across this situation or managed to install 2 SAP instances in one Cluster Group based on Windows 2003, SQL Server 2005.
Regards

I am not quite sure if I understood your problem completley. But let's see...
Usually you use on on MSCS Cluster Group per SAP instance. So you have your already existing NW 7.0 ABAP stack in a separated Cluster Group, and you create a new Cluster Group for your new Java system.
You can find more information about it in this guide here on SDN:
Link: [High Availability;
More information about High Availability Setups for SAP System can be found here on SDN:
Link: [High Availability]
If you want to use the same database for your clustered ABAP stack and your new Java stack you can do a MCOD installation.
Please see Link: [SAP Note 388866 - Multiple Components on One Database - Installation|https://service.sap.com/sap/support/notes/388866]
Hope this helps.
Best regards,
Mathias

Assignment of One Solution ManagerDiagnostics Agent to Multiple SAP Systems

Dear Experts,
according to the Powerpoint presentation attached to SAP Note 1365123, one single Solution Manager Diagnostics Agent can be used for E2E RCA with multiple SAP systems running on its physical host.
I have installed one Diagnostics Agent on a server where three ABAP systems are running. Each ABAP system on this server has been installed under an alias (i.e. all these SAP systems are reachable under the same IP address. No virtual servers with individual IP addresses have been defined.). I want to configure each ABAP system for E2E RCA. When running the Managed Systems Setup procedure for E2E RCA, I am not able to assign the diagnostics agent to more than one of these ABAP systems - after the first system has been configured for E2E RCA, the entry for the Diagnostics Agent on this particular server is no longer available in the drop-down list of Diagnostics Agents when configuring the next system.
Is my understanding of the presentation mentioned above wrong, or am I missing a trick here? How can I assign the Diagnostics Agent to all three SAP systems that are running on the same physical host?
Details about the environment:
SAP Solution Manager: SAP EHP1 for Solution Manager 7.0 (SP Level 24)
Diagnostics agent version : 7.01.7.0.20100326100205
Thank you for your time,
Rainer Walter

Hello,
Have you followed all the rules?
Rule 1
Consider the diagnostic agent as a standard SAP system
Rule 2
Install one Diagnostic Agent per host (Physical or Virtual) (You mentioned you don't have virtual hosts)
Rule 3
Each Diagnostic Agent gets mapped to the SMSY repository using the server name key
Rule 4
Do not install a Diagnostic agent on a host that only run databases or SAP Central Services
Rule 5
An Agent can only conenct to one single Solution Manager System
If you install multiple Diagnostic Agents on the same host, each one needs to be connecting to a different Soltuion Manager system
Rule 6
Choose the adequate diagnostic agent installer/version
Rule 7
In a switch over scenario diagnostic agent must move with their respective virtual host and managed components
These are the rules attached to SAP Note 1365123. You need to comply to the rules.
If you have multiple agents ont he same host, then they need to conenct to different solution manager systems....according to the rules. One agent per physical host is one of the rules...specifically rule #2. This is my take, and it seems pretty clear here.
Regards,
Paul

Centralised EHS system and users and organisations in multiple SAP systems

Wanted to have your experience/ advice or experience in setting up a centralised EHS system talking to multiple SAP systems and other ERP systems
If the client have sister companies and locations in multiple SAP systems , can we go for a centralised EHS system talking to multiple SAP systems
Is there a concept of application ID in EHS system : If so how EHS system can identify the < to EHS system records to tag the system > , <EHS system Records bound to have different configs for each ERP systems> and < from EHS system records to multiple SAP systems >
Can you list client experiences or roadblocks for this type of design

Hello
the answer to your question is: may be you can use a central EHS system. The reason is: EHS is correlated with MM. A SAP system in which EHS is used without MM makes "not realy" sense. So it is a matter of definition "what is a central EHS system".
EHS it selfs uses SAP standard techniques. That is "ALE" distribution to other SAP systems. The distribution of EHS data top NON SAP systems is possible to via XI (which is the common solution). If you use as the scenario SAP to SAP you must make your that standard EHS customizing is the same on both sides.
Furthermore SAP EHS is a "great" module with several submodules. So regarding each of the potential scenerios you need to check the necessary prerequisites. It ois very common to have EHS PS, DG, HSM in one system and to distribute data via ALE to a different system so that the EHS data can be used "decentral" in the several SAP logistic processes.
In most cases you need to distribute per ALE at least DG master and hazardous substance master.
As a starting point take a look here: http://help.sap.com/erp2005_ehp_05/helpdata/en/c1/eda0f591ec12408b25e7a1b369ca45/frameset.htm
BASIC Data and Tools => Tools => Distribution of specifications, phrases and reports per ALE.
Hope this helps.
With best regards
C.B.

Installing data quality management for sap for multiple sap system

Hello folks,
I have an Requirement where i need to install data quality management for sap in multiple sap system.
I have installed it successfully for one system .
here my data services is installed in one server with rfc server as windows services in same server.
i have done the required configuration in ecc side.
my question is how do i use same data services jobs which are configured as real time services for both my sap connection?
in simple terms how do i installed dqm for multiple sap system having single data services server.
thanks,
Shubhangi.

Hi Vishal,
Regarding DQM Please refer the below Link.
Links:
http://scn.sap.com/community/data-services/blog/2013/07/18/i-installed-dqm-for-sap-you-can-too
or you can also refer below SNotes given by SAP:
1732816 - How to manually import DQM ATL files correctly after failed install
Note 1732816 - DQM Adapter Dataflow installer fails on Data Services 4.1
Links:
https://service.sap.com/sap/support/notes/1732816
Thanks,
Daya

Multiple SAP systems - Single Content Server

In a production landscape with multiple SAP systems and a single Content Server, would it be more efficient to allow each Web AS to access the Content Sever directly or should there be a single dedicated Web AS to access the single Content Server?
We do not have any load data; we are trying to find out if there are any heuristics for such a configuration.
Message was edited by: John Ryan

You may use the SAP Content server for data archiving. If you use content server, you may not be be able to satisfy the legal requirements as SAP content server cannot support a WORM devise.
SAP do not recomment using SAP CS for Data archiving as well. SAP CS could be best used as a temporary content stoarge for non legal document images.

Connecting One process Server to Multiple SAP Systems

Hi Experts,
We have a licensed version of the SAP CPS with the Process server limit parameter set to 4, which means we are limited to 4 process server as per my understanding. But when we create a SAP system the process server and the respective Queue is automatically created. SO that means we can create a max number of 4 SAP systems with 4 process servers!!
Or is there a way we can connect one process server with multiple SAP systems ?
Thanks,
Eric.

Yes - Process server limit parameter set to 4 means your CPS environment can start jobs in 4 SAP systems only.
Maybe "SAP Business Automation Enabler (BAE) Connectors" could be useful to you in your situation.
- Check the CPS admin guide for more information on BAE connector.
Regards,
David

Multiple SAP systems on One database

Hello,
We are planing to install multiple SAP systems like SM, ERP on one database with multiple DB SIDs, it means each SAP system has its own Oracle instance. We know MCOD has only one DB SID (one oracle instance) for multiple SAP systems.
Is it possible to set up the landscape like this? Is it supported by SAP?
Can any body advice?
Thanks,
Kris

>
Kris wrote:
> Thanks Markus,
>
> But we want to install one DBMS home for all oracle instances for different SAP components. Is it possible?
>
>
> Thanks,
> Kris
Technically, it is possible.
But SAP Does NOT support it. The only method to install one set of binaries (one ORACLE_HOME) that is supported by SAP is to use MCOD (all components are installed in one Database)

Single ADS for multiple SAP systems ?

Can a single ADS installed in a JAVA stack possibly along a EP 7.0 serve multiple SAP systems in my landscape. We got ECC 6.0, EP 7.0, BI 7.0, SRM 5 etc in our landscape. I was wondering whether I can install ADS on any of these systems with Java stack and leverage the functionality to other SAP system or should I have ADS on all the Systems ?
Help appreciated
Thanks

We are using one ADS for more than 10 systems in our product development. It works fine.

Using same Wildcard certificate on multiple SAP systems with same domain name.

Similar Messages

Maybe you are looking for