X509 based logon – 3 – Create a user certificate
The user needs to have a valid X.509 certificate to be able log on at the SAP System (via ICM service). This certificate is issued by the intermediate CA. Create a CSR for a user and let the intermediate CA sign it. Following my own blogs, I get a certificate named: tobias.crt.pem. Following commands assume that you are using my CA setup.
Create request for user certificate (CSR)
openssl req -out intermediate/csr/tobias.csr.pem -newkey rsa:4096 -nodes -keyout intermediate/private/tobias.key.pem -config intermediate/openssl_intermediate.cnf
Sign request by intermediate CA
openssl ca -config openssl_intermediate.cnf -extensions usr_cert -days 3050 -notext -md sha512 -in csr/tobias.csr.pem -out certs/tobias.crt.pem
I have a key, signing request and certificate. The key and certificate are needed to be able to log on. The X.509 user certificate looks like this:
-----BEGIN CERTIFICATE----- MIIHyjCCA7KgAwIBAgICIAAwDQYJKoZIhvcNAQENBQAwSTELMAkGA1UEBhMCREUx CzAJBgNVBAgMAkJXMQ0wCwYDVQQKDAREZW1vMR4wHAYDVQQDDBVpbnQuaXRzZnVs ... wJCKYDK6yxxhrKkgrg+kJ9vYzMpgqNUA1DuXX8+ckVpcMnjXEW5vJivt50/BtJL2 nfI0JuhlyZ6SDnsx5svy1uSAaeezUiWWOXpOasoEnGuhJJhDG2c+LTUsvcFE2MCh 29KtXiI1jPsi2/LE8F3EoK4aR+ex99otrN/yT6V3 -----END CERTIFICATE-----
This certificate needs to be added to the browser. I am using a Mac and will use Safari for logging in with my X.509 user certificate at NW ABAP. Convert the PEM certificate to PFX format. The PFX file will contain the user key and the certificate signed by the intermediate CA. Secure the PFX file with a password.
openssl pkcs12 -export -out tobias.pfx -inkey tobias.key.pem -in tobias.crt.pem -certfile rootca/certs/ca.itsfullofstars.de.crt.pem -certfile intermediate/certs/int.itsfullofstars.de.crt.pem
For Safari to be able to use this user certificate, import the PFX file to the Mac OS Keychain.
After the import, your user certificate is included in the keychain. To see if Safari can read your user certificate, open SAP WebGui for HTML in Safari.
Safari should ask you to select a valid user certificate.