{"id":111,"date":"2025-01-23T13:52:54","date_gmt":"2025-01-23T13:52:54","guid":{"rendered":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/?p=111"},"modified":"2025-08-15T08:39:34","modified_gmt":"2025-08-15T08:39:34","slug":"sap-secure-network-communication-snc-encryption-configuration-from-sap-portal-to-abap-systems-and-sap-gui-to-abap-systems","status":"publish","type":"post","link":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/2025\/01\/23\/sap-secure-network-communication-snc-encryption-configuration-from-sap-portal-to-abap-systems-and-sap-gui-to-abap-systems\/","title":{"rendered":"SAP Secure Network Communication (SNC) Encryption configuration from SAP Portal to ABAP systems and SAP Gui to ABAP systems"},"content":{"rendered":"\n

Encrypt the SAP Portal traffic to SAP ABAP systems and SAPGUI encryption to ABAP systems as part of their Infosec policy. Encryption is implemented using the SAP Secure Network Communication (SNC). This document explains about step by step configuration of SNC Encryption on the existing SAP Gui to ABAP systems and SAP Portal Traffic to ABAP systems. SNC can be implemented in HANA On premise and Hana Cloud Landscapes as well.<\/p>\n\n\n\n

Landscape<\/strong>
In order to demonstrate this configuration, the below landscape is required
\u2022 SAP ABAP Systems: ECC, SRM, GRC, HR, PI and Solution Manager
\u2022 SAP GUI 7.5 running on windows
\u2022 Active Directory service user account
\u2022 SAP Netweaver Application Server ABAP with Common Crypto Library installed
\u2022 Microsoft Windows Domain Controller
Tools<\/strong>
\u2022 LIBSAPCRPYTO Library files
\u2022 Microsoft Active Directory ADSI
\u2022 Microsoft Kerberos
Conclusion:<\/strong>
SNC Encryption enhances the exisiting SAP Cloud and On-Premise environment with high level security and the communications between the SAP systems are highly secured.<\/p>\n\n\n\n

Configuration Steps:<\/strong>
Pre-Requisites:
\u2022 SAP GUI Installed on a computer running on Microsoft Windows
\u2022 Microsoft Windows Domain Controller \u2013 Service SPN accounts and SPN configuration
\u2022 SAP Netweaver Application Server ABAP with Common Crypto library installed<\/p>\n\n\n\n

Check the SECUDIR environment variables defined for the sec directory<\/p>\n\n\n\n

Check the SNC library path<\/p>\n\n\n\n

Backup of the existing sec folder and profile directory
Profile directory<\/p>\n\n\n\n

sec directory<\/p>\n\n\n\n

Create the SPN accounts : service user in Microsoft Active Directory
Example : KerberosABC<\/p>\n\n\n\n

Set the checkboxes as below:<\/p>\n\n\n\n

Goto ADSI edit and set the Service Principle Name for Service user as ie. SAP\/Kerberos<\/p>\n\n\n\n

Check the Service Principal Name is unique<\/p>\n\n\n\n

Create SNC pse file as below command
sapgenpse get_pse -p < path to the sec directory\/xxxx.pse> -x \u201cCN=\u201d<\/p>\n\n\n\n

Create the credentials
sapgenpse seclogin -p -o<\/p>\n\n\n\n

Now log in to the ABAP system
Goto Transaction : STRUSTSSO2
create SNC SAP Cryptolib PSE file right click the SNC SAP Cryptolib as below:<\/p>\n\n\n\n

Remove the default values of Org(opt) & comp\/org and maintain the below values and SAVE<\/p>\n\n\n\n

Now select SNC SAP Crypto pse and Double click the CN=XXXXXX@XXXX.com<\/p>\n\n\n\n

Press Export button and export to your machine.
Use the name .cert<\/p>\n\n\n\n

Select \u201cBase64\u201d as .cert
Exchanging the Public-Key Certificates<\/p>\n\n\n\n

Save the crt into the sec directory of portal dev system
Export certificate of Java SNC PSE
sapgenpse export_own_cert -o -x<\/p>\n\n\n\n

Import ABAP SNC certificate into Java SNC PSE
sapgenpse maintain_pk -p \/usr\/sap\/J00\/sec\/xxxx.pse -a \/usr\/sap\/\/J\/sec\/xxxx.cer<\/p>\n\n\n\n

To get the details of the certificate
sapgenpse get_my_name -p
Import Java SNC certificate into ABAP SNC PSE<\/p>\n\n\n\n

Maintaining the System ACL on the AS ABAP
Goto Transaction SM30 -type VSNCSYSACL and next screen select \u201cE\u201d and click new entries
And add the system and SNC name ex. P:CN=xxxx@org.com as below:<\/p>\n\n\n\n

Maintain SNC related parameters in instance profile of Java system and ABAP system
Java System parameter as below:<\/p>\n\n\n\n

ABAP Systems (ECC) Parameters as below<\/p>\n\n\n\n

Now continue with the Portal configuration as below:
Portal SNC with Backend System (ECC)<\/p>\n\n\n\n

\u2022 System Object creation (using Connection String):<\/p>\n\n\n\n

Then, maintained connection string as mentioned below.
Connection String: \/H\/\/S\/3200 SNC_PARTNERNAME=\u201dp:CN=xxxxxxxxxx@xxxx.com\u201d SNC_QOP=9<\/p>\n\n\n\n

\u2022 Transaction Iview details:
As per note: 1881298 created 2 sample transaction iviews and maintained below property
Additional Parameters to start SAP GUI: SUPPORTBIT_ON=NEED_STDDYNPRO
Iview 1 Name: ECC SNC<\/p>\n\n\n\n

3) Testing iview from Portal:<\/strong><\/p>\n\n\n\n

Pad lock is \u201cON\u201d & SAP backend (ECC) is connected from portal using SNC.<\/p>\n\n\n\n

Updating the SAPGUI xml properties with the SNC details of respective SAP systems:<\/p>\n\n\n\n

Update the SAPGUI .xml details with the corresponding system name and SNC names<\/p>\n\n\n\n

SAPGUI logon pad all the SAP systems are encrypted with key lock as below<\/p>\n\n\n\n

RFC connections are encrypted with SNC as below:<\/p>\n\n\n\n

End of the configuration.
Courtesy:- Rajeshkumar Srinivasan<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Encrypt the SAP Portal traffic to SAP ABAP systems and SAPGUI encryption to ABAP systems as part of their Infosec policy. Encryption is implemented using the SAP Secure Network Communication (SNC). This document explains about step by step configuration of SNC Encryption on the existing SAP Gui to ABAP systems and SAP Portal Traffic to […]<\/p>\n","protected":false},"author":1,"featured_media":112,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","om_disable_all_campaigns":false,"pagelayer_contact_templates":[],"_pagelayer_content":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-111","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-content\/uploads\/2025\/01\/pic22.png?fit=781%2C301&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/posts\/111","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/comments?post=111"}],"version-history":[{"count":1,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/posts\/111\/revisions"}],"predecessor-version":[{"id":113,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/posts\/111\/revisions\/113"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/media\/112"}],"wp:attachment":[{"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/media?parent=111"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/categories?post=111"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vaaasglobalsolutions.co.uk\/Blog\/wp-json\/wp\/v2\/tags?post=111"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}