Introduction
This blog documents the steps required to configure SSL/TLS encryption between SAP ABAP application servers and an SAP HANA database, using a certificate signed by an external Certificate Authority (CA). This is a common requirement in enterprise migrations and security hardening projects where the default SAP-generated certificates are replaced with organisation-specific ones.
The configuration covered here implements one-way TLS — the HANA database server authenticates itself to the ABAP application layer. sapcli.pse on each ABAP node serves as the trust store, allowing the ABAP kernel to verify HANA's certificate during the TLS handshake. This guide assumes you are working on a Linux-based SAP system with SAP CommonCryptoLib installed.
