How to Install an SSL/TLS Certificate on SAP ECC and S/4HANA (ABAP/STRUST)

ECC and S/4HANA ABAP systems don’t use a standalone PSE file the way SAP Web Dispatcher does – certificate management is done inside the ABAP stack itself, through the Trust Manager (transaction STRUST), which wraps SAP’s SSF library. The concepts are the same – PSE, CSR, signed certificate, chain – but the tooling is a SAP GUI transaction rather than a command line.

As with Web Dispatcher, this matters more than it used to: under the CA/Browser Forum’s SC-081 ruling, public certificate lifetimes are shrinking to 200 days from March 2026, 100 days from 2027, and 47 days from 2029. This guide covers a one-off install; see our guide to automating renewal with SAP Secure Login Server for the automated side.

Before you start

  • SAP GUI access to the system, with authorization for STRUST (the S_RZL_ADM or equivalent Basis authorization object, depending on your authorization concept).
  • Know which PSE you’re targeting: SSL server Standard is the system-wide default used by most application servers, but a landscape can also have a separate PSE per application server if it’s set up that way – check with whoever configured HTTPS on this system if you’re not sure.
  • Confirm HTTPS is actually active on the ICM already (see Step 5) – if this is a genuinely new setup rather than a renewal, you’ll need that step; if HTTPS is already working and you’re just replacing an expiring certificate, you can skip it.

Step 1: Open Trust Manager and find the right PSE

Run transaction STRUST. In the PSE tree, expand SSL server PSEs and select the entry for your system – SSL server Standard for the system-wide certificate, or the specific application server if your landscape uses per-server PSEs.

Step 2: Generate a CSR

With the right PSE open, use Create Certificate Request (right-click, or the corresponding toolbar option depending on your NetWeaver release). Fill in the certificate’s subject – common name should be the fully-qualified hostname your users and integrations actually connect to. STRUST displays the generated CSR as text; copy the whole block, including the BEGIN/END markers.

Step 3: Get the CSR signed

Submit the CSR to your certificate authority the same way you would for any system. If you haven’t sourced a certificate yet, you can browse and buy SSL certificates here directly. You’ll get back a signed certificate, plus the CA’s intermediate and root certificates.

Step 4: Import the certificate response

Back in STRUST, on the same PSE, use Import Certificate to load the signed certificate, then the intermediate and root certificates. Each one needs to be added to the certificate list in the PSE – STRUST shows this as a chain once all three are in place. Save the PSE.

Step 5: Activate HTTPS on the ICM (first-time setup only)

If HTTPS isn’t already listening on this system, you’ll need an ICM port for it. In transaction RZ10, on the relevant instance profile, add a parameter along these lines:

icm/server_port_3 = PROT=HTTPS,PORT=443<nn>,PROCTIMEOUT=15,TIMEOUT=15

(the exact parameter number and port depend on what’s already defined on your instance – don’t reuse a number that’s in use). This kind of profile change needs an instance restart to take effect, unlike a straightforward certificate swap in an already-active PSE, which doesn’t. If HTTPS was already working before you started and you’re just replacing an expiring certificate, you can skip this step entirely – Steps 1-4 are enough.

Step 6: Verify the certificate is live

Check the certificate a browser sees on the system’s HTTPS URL, and confirm the expiry date and issuer match what you just imported. You can also confirm the chain looks correct directly in STRUST by reopening the PSE and reviewing the certificate list.

What’s next

A manual STRUST import gets you sorted today, but under SC-081’s shortening lifetimes you’ll be doing this several times a year per system unless it’s automated. Our guide to automating ECC and S/4HANA certificate renewal covers setting that up through SAP Secure Login Server – background jobs SSF_CERT_ENROLL and SSF_CERT_RENEW – so this is the last one you do by hand. If something didn’t go to plan, our troubleshooting guide covers the errors we see most often here.