Option 1 : Configuring the SAP Web Dispatcher for End-to-End SSL

If the SAP Web Dispatcher is to pass the SSL connection to the server in the back
end, set the following profile parameter in the SAP Web Dispatcher's profile:

icm/server_port_<xx> = PROT=ROUTER, PORT=<port>, TIMEOUT=<timeout_in_seconds>

For more information about the SAP Web Dispatcher's profile, see Parameterization
of the SAP Web Dispatcher .

Example : icm/server_port_0 = PROT=ROUTER,PORT=60000 (PROT=ROUTER is only used when

we have end-to-end SSL scenario, for other scenarios, we either use HTTP/HTTPS)

icm/server_port_1 -> This is a twin parameter for icm/server_port_0 when we use the
PROT=ROUTER, this parameter is used to establish HTTPS communication between Web
Dispatcher and Web AS (to exchange the metadata)
Example : icm/server_port_1 = PROT=HTTPS,PORT=0

In this case, you do not need to set up any PSEs or establish trust between the
components.

Option 2 : Configuring the SAP Web Dispatcher for SSL When the Connection is
Terminated and SSL is Used :

1. Install the SAP Cryptographic Library on the SAP Web Dispatcher .

2. Create the SAP Web Dispatcher's PSE(s) and certificate request(s) .

Create an SSL server PSE if the incoming connections use SSL. Create an SSL client
PSE if the outgoing connections use SSL. Create both if both connections use SSL.

3. Perform the following steps for each of the PSEs you created in the previous
step.

Send the certificate request(s) to a CA to be signed .

Import the certificate request response(s) into the PSE .

**configuration tool sapgenpse or the trust manager to import the

certificate request into the PSE.

**Use the same tool that you used to create that PSE(s) and certificate
request(s).

Create credentials for the SAP Web Dispatcher .

Sample Profile for the SAP Web Dispatcher When Terminating SSLLocate this document
in the navigation structure
Use
# SAPSYSTEMNAME must be set so that the default profile is

# read. If not, a warning is displayed on the console.

SAPSYSTEMNAME = ABC

# SAPSYSTEM must be set so that the shared memory areas

# can be created.

# The number must be different from the other SAP instances

# on the host.

SAPSYSTEM = 26

# Set DIR_INSTANCE so that the SAP Cryptographic Library can

# find the sec sub-directory.

DIR_INSTANCE = C:\Program Files\SAP\SAPWebDisp

# Message Server Description

rdisp/mshost = abcmain

ms/http_port = 8081

ms/https_port = 8443

# Description of the Access Points

icm/server_port_0 = PROT=HTTP, PORT=1081, TIMEOUT=900

icm/server_port_1 = PROT=HTTPS, PORT=1443, TIMEOUT=900

icm/HTTPS/verify_client = 0

# Parameters for the SAP Cryptographic Library

ssl/ssl_lib = C:\Program Files\SAP\SAPWebDisp\sapcrypto.dll

ssl/server_pse = C:\Program Files\SAP\SAPWebDisp\sec\SAPSSLS.pse

# Parameters for Using SSL to the backend server

wdisp/ssl_encrypt = 2

wdisp/ssl_auth = 2

wdisp/ssl_cred = SAPSSLC.pse

wdisp/ssl_certhost = www.mycompany.com

**Creating Credentials for the SAP Web Dispatcher is not reuired If the
SAP Web Dispatcher is to pass the SSL connection to the AS ABAP, you do not need to
perform these steps.

4. For outgoing connections that use SSL, import the CA root certificate for the CA
that issued the back-end application server its SSL server certificate into the SAP
Web Dispatcher's SSL client PSE.

5. Set the profile parameters according to the case you are using (see the figure
above).

6. Restart the SAP Web Dispatcher.

7. Test the connection .