We support TLS/SSL handshaking for one-way authentication between a SAP CC client and SAP CC core server.

In one-way mode, only SAP CC Client validates the SAP CC Core Server to ensure that it receives data from the intended SAP CC Core Server. For implementing one-way mode, the SAP CC Core Server shares its Certificate(s) with the SAP CC Client.

To allow SAP CC agents to connect to the SAP CC Core Server with TLS enabled, you must:

1. Configure SAP CC Core Server with one-way authentication for the respective Instance and Services.

2. Configure SAP CC Client to trust SAP CC Core Server.

Configure SAP CC Core Server

To secure SAP CC Core Server communication service, follow this SAP Support page: Secure an SAP CC Core Server communication service

Before we can start configuring SAP CC Core Server, we need to know that SAP CC agents in MZ are connecting to the Dispatcher instance through the TCP-IP layer:

Open

SAP CC Architecture Diagram including SAP CM as a third-party element.

For our case, you will turn on one-way for ExternalSecure targeted service on the Dispatcher instance.

Configure SAP CC To Trust SAP CC Core Server

Take the SAP CC Core Server’s Public Certificate (X.509v3 format encoded in DER), and configure in SAP CC client to trust the SAP CC Core Server.

One of the example method is using the keytool command to add this server certificate to client truststore, and use this truststore for your SAP CC agent.