Prerequisites

To be able to add the certificate to transaction STRUST in the ABAP system, please make sure that your user has the following authorizations:

  • Authorization Object: S_TCODE
    • Field TCD = STRUST
  • Authorization Object: S_GUI
    • Field ACTVT = 60
  • Authorization Object: S_PSE_ADM
    • Field ACTVT = 01,02
    • Field PSECONTEXT = '*' 
    • Field PSEAPPLIC = '*' 
  • If authorization object S_PSE_ADM doesn't exist in your system please assign S_RZL_ADM with
    • Field ACTVT = 01

Download & import certificate

Download the certificate
  1. Download the certificate from https://cacerts.digicert.com/DigiCertGlobalRootG2.crt(opens in new tab)
    (currently used to sign certificates)
  2. Download the certificate from https://cacerts.digicert.com/DigiCertTLSRSA4096RootG5.crt(opens in new tab) (prepares the trust store for future use requiring increased key length)

For more information, please also check the following Technology Blog Post on SAP BTP Cloud Foundry: switching to higher security level Root Certificate Authority(opens in new tab).

 

Import certificate into STRUST

You need to import all certificates to both the SSL Client (Anonymous) as well as the SSL Client (Standard) in the transaction STRUST in your ABAP system.

  1. Log on to your ABAP system
  2. Go to transaction STRUST
  3. Switch to change mode (Ctrl+F1)
  4. Double-click on "SSL client SSL Client (Anonymous) in the navigation tree on the left side
  5. Click menu "Certificate" > "Import"
    1. Use the file path selector to select your DigiCert Root CA certificate downloaded before
    2. Click the button with the green check-mark
  6. Click menu "Edit" > "Add certificate"
  7. Double-click on "SSL client SSL Client (Standar" in the navigation tree on the left side
  8. Make sure the certificate information are still visible in the "Certificate" area in the lower right panel
  9. Click menu "Edit" > "Add certificate"
  10. Repeat steps 4 to 9 for all remaining certificates
  11. Click the "Save" button