Server-side SSL configuration on HANA for inter-node communication and System Replication using openSSL

I have been seeing a growing number of security related questions from customers. This blog will cover step-by-step configuration of SSL for internal communication and system replication. I hope this will help you guys out.

Security is one of the most significant feature any product should posses. In SAP HANA, we can precisely configure both internal and external communication.

Secure your HANA Cloud Connector with OpenSSL certificates – Part 3

In parts 1 and 2 of this blog series, I showed how to secure your SCC with a trusted UI Certificate as well as how to further secure your SCC with a trusted System Certificate, put your CA certificate in the Trust Store, install a SCC CA Certificate and with that enable Principal Propagation. As a result, we got 4 green boxes in the SCC General Security Status:

Enabling on premise Fiori SSO with OpenSSL certificates – Part 1

I had described how to enable single-sign-on based on OpenSSL for Windows on a Web AS ABAP sandbox system and this information is still valid. However, both the NWAS ABAP as well as the OpenSSL tools have evolved considerably since 2012 so that I will describe an updated approach for Fiori single-sign-on in this blog series. I will start with explaining how to setup a sucure SSL connection to the Fiori Launchpad based on OpenSSL certificates.

Again, this blog is intended for you to learn and understand the concepts. Neither key lengths nor other security considerations except for making this example work have been considered.

Secure your HANA Cloud Connector with OpenSSL certificates – Part 1

Out of the box, the HANA Cloud Connector (SCC) is not secure, as clearly documented by the General Security Status:

As mentioned in the General Security Status, the out of the box SSL certificate does not use the host name as its common name (CN) and is therefore not trusted:

Enable TLS on HANA Web Dispatcher with OpenSSL certificates

Out of the box, my HANA Web Dispatcher comes with a self-signed SSL certificate, which makes its connections insecure:

Securing the Communication between SAP HANA Studio and SAP HANA Server through SSL

Pre-requisites:

HANA Server is installed and running
HANA studio is installed in the local system
Access to the HANA server
Putty / WinSCP tools

HANA Server and client without SSL configured:

Configure ABAP to HANA SSL connection

The below instructions are based on sapcrypto. In SP7, there is an option to use commoncrypto. OpenSSL is also an option if sapcrypto is not installed.

• Install sapcrypto on both CI and HANA systems
• This is well documented, so I won't provide details here
• Copy libsapcrypto.so to .../lib directory
• cp libsapcrypto.so /usr/sap/<sid>/SYS/global/security/lib
• Create PSE files for both the CI and HANA systems
• See 1718944 - SAP HANA DB: Securing External SQL Communication (SAPCrypto)
• If a Certificate Authority (CA) is not available, SAP provides an option to create a test cert that is valid for 8 weeks: https://websmp110.sap-ag.de/tcs

SAP HANA SPS 11 What's New: Security - by the SAP HANA Academy

Introduction

In the upcoming weeks we will be posting new videos to the SAP HANA Academy to show new features and functionality introduced with SAP HANA Support Package Stack (SPS) 11.

* What's New with SAP HANA SPS 11 - by the SAP HANA Academy

The topic of this blog is security.

SAP HANA Academy - SAP HANA SPS 11: What's New? - Security - YouTube

How to Secure the Communication between SAP HANA Studio and SAP HANA Server through SSL

This blog shows you, how to secure the communication between HANA Server and HANA Studio through SSL. It is highly recommended when there are lot of sensitive data handled in the system, which you want to secure from the middle-man attacks. There could be multiple documents available in SCN on this topic, but here I wants to show my experience on setting this up, in short time.

Pre-requisites:

• HANA Server is installed and running
• HANA studio is installed in the local system
• Access to the HANA server
• Putty / WinSCP tools 

HANA Server and client without SSL configured: