In the following it is described, how you can setup SDA using its own keystore:

The SDA can act as client and as server. Mostly, the SDA operates as a client. In the setup of system landscape data router (SLDR) the SDA operates as a server. The documentation below describes the steps to set up TLS and SSO in the SDA keystore.

Expert tasks for the maintenance of the SDA keystore are described in the following notes. Whether these tasks need to be executed depends on your security policy.

Notes for optional operations:

To reuse certificates from PCKS#12 keystore, follow the SAP Note 2633417

To enable server certificate verification at TLS handshake, apply SAP Note 2632984

To allow usage of keystores and certificates protected by custom passwords, follow SAP Note 2651765

To enable SNC on SDA for secure communication from SDA to ABAP, follow SAP Note 2607542

The SDA as a client can make authenticated requests to servers using a client certificate. 
Prerequisite:  Signed client certificate in PKCS#7 format. Install a client certificate into the java keystore by using keytool (shipped with SAPJVM) as follows:

($FILE stands for the client certificate file name)

The SDA can act as a HTTP server. Current use case is the Simple Landscape Data Router (SLDR). For a client to communicate with the SLDR via SSL, an SLDR server certificate is needed. Install the server certificate into the SDA's keystore by using keytool as follows:

($FILE stands for the client certificate file name)

The SDA validates client certificates of communication partners with the root certificate in the trust store. Install a CA certificate into the SDA's trust store by using keytool as follows:

($FILE stands for the client certificate file name)

Explain Inbound Configuration

Starting SDA version 1.16 every port can have its own configured user.

For every inbound channel the following properties are supported: 

• "port" = digit number which opens a tcp/ip port for incoming requests. This port will be used to configure the data supplier of the managed system.
• "secure" = true/false, where true stands for HTTPS and false for HTTP. The default value is false.
• "basic-auth"=true/false, where true stands for authorization via basic authentication and false for certificate-based authentication . The default value is true.
• "user"= the subject of the client certificate, if basic-auth=false (e.g. user= CN=wdflbmd16834.wdf.sap.corp,OU=SE,O=SAP,C=DE). If basic-auth=true, then the user can be configured as desired (e.g. user=SLD_DS_USR).
• "password" = the password specific to the user of that port; this will validated if basic-auth=true

If only one inbound port needs to be configured, there is no unique identifier necessary. Otherwise, if further inbound ports are needed then, they can be configured by adding a dot followed by a non-empty sequence of digits to the keyword "port", e.g." port.1", "port.2", "port.3", etc. The same applies to the "secure", "basic-auth", "user", "password" properties. 

Explain Outbound Configuration

For every outbound channel the following properties are supported. The outbound configurations needs always an unique identifier as suffix: 

• "URL.<ID>" = true/false, where true stands for HTTPS and false for HTTP. The default value is false.
• "user.<ID>"= the user name needs to be configured as desired (e.g. user=SLD_DS_USR) for basic authentication. Otherwise the SDA tries to authenticate using certificates
• "password.<ID>" = the password specific to the user of that port;
• "primary.<ID>" = true/false; where true identifies the system which return code is used to forward to the data supplier client 

If further outbound ports are needed then, they can be configured by adding a dot followed by a non-empty sequence of digits to the keyword "port", e.g." port.1", "port.2", "port.3", etc. The same applies to the "secure", "basic-auth", "user", "password" properties.

Send the Configuration

To activate and configure the SLDR a proper configuration request needs to be executed against the SDA. This can be achieved manually by sending an HTTP POST request to the SDA with the following URL:

The body of the request has to contain the following JSON formatted configuration:

If the configuration is saved in a file (JSON formatted), say SLDR.CONFIG, you could use the following command to apply it to the SLDR:

As this request is addressed to the SAP Host Agent and all services of it require authentication, the sapadm user and password need to be used.

No restart of the SDA is required.

Addendum

Example Setup Keystore

Prerequisites: Signed certificate in PKCS#7 format exists (e.g. "cert_request_response.txt"). 

Example SLDR Configuration

Do not use the SLDR configuration UI in the agent administration in case of complex configurations for FRUN FP02.

The below example configuration is for the example use case.

First create SLDR-config file (e.g. SLDR.CONFIG) in JSON format.

Send the SLDR configuration as a HTTP-POST request to the following URL:

You will find the transferred properties at /usr/sap/hostctrl/SMDAgent/default/configuration/t-connector/FRN/custom.properties. Based on our example with HTTP as outbound configuration, the file has the following content. Any passwords are stored encrypted at /usr/sap/hostctrl/SMDAgent/default/configuration/t-connector/FRN/secure.properties.