NetWeaver AS Java systems – including SAP PI/PO – manage certificates differently again from Web Dispatcher and ABAP/STRUST. There’s no sapgenpse and no STRUST transaction here – everything happens through NetWeaver Administrator’s (NWA) Key Storage, a web UI rather than SAP GUI or a command line.
Same underlying pressure as the other guides: under the CA/Browser Forum’s SC-081 ruling, public certificate lifetimes are shrinking to 200 days from March 2026, 100 days from 2027, and 47 days from 2029. This guide covers a one-off install; see our guide to automating renewal for the automated side.
Before you start
- Admin access to NetWeaver Administrator, normally at
http://<host>:5<NN>00/nwa(replace<NN>with your instance number). Older systems (pre-7.3-ish) may still be on Visual Administrator instead of NWA – the same steps apply under server → services → Key Storage → service_ssl there. - Know whether HTTPS is already active on this system. If it is, you only need Steps 1-3 and 5 below. If this is a genuinely new setup, you’ll also need Step 4.
Step 1: Create the SSL credentials entry and generate a CSR
In NWA, go to Certificates and Keys → Key Storage. Systems often ship with a default ssl-credentials entry that has the wrong CN/DN for your domain – rather than editing it in place, it’s cleaner to create a new credentials entry with the correct subject details (CN should be the hostname your integrations actually connect to). Open the new entry, go to View Entries, select it, and choose Generate CSR Request. Download the resulting CSR.
Step 2: Get the CSR signed
Submit the CSR to your certificate authority as usual. If you haven’t sourced a certificate yet, you can browse and buy SSL certificates here directly. You’ll get back a signed certificate, typically alongside a PKCS#12 bundle and the CA’s chain certificates.
Step 3: Import the signed certificate
Back in the Key Storage entry, use Import Entry (for a PKCS#12 key pair) or Import CSR Response if you’re completing the same request you generated in Step 1 – which one applies depends on what your CA gave you back. Import the server certificate and the CA’s root/intermediate certificates. Once loaded, use Export View to PSE so the ICM can actually pick up the new certificate – this writes the PSE file the ICM reads, and it’s an easy step to miss, since the certificate can look correctly imported in the keystore view without it.
Worth knowing separately: there’s also a TrustedCA keystore view in Key Storage. That’s for certificates your system needs to trust when calling out to other systems (SSL client trust), not for your own server certificate – don’t confuse the two views, they solve different problems.
Step 4: Activate HTTPS on the ICM (first-time setup only)
If HTTPS isn’t already listening, add an SSL port in NWA under Configuration, or directly as instance profile parameters, along these lines:
icm/server_port_2 = PROT=HTTPS, PORT=5<NN>01, SSLCONFIG=ssl_config_2
icm/ssl_config_2 = VCLIENT=0, CRED=/usr/sap/<SID>/<instance>/sec/SAPSSLS.pseThis requires a full instance restart to take effect – unlike a routine certificate swap on an already-active port, which doesn’t. Skip this step entirely if HTTPS was already working before you started.
Step 5: Restart the SSL Provider service
Whether or not you touched the ICM port, restart the SSL Provider service (via NWA’s Operations/service management, or a full instance restart if you also did Step 4) so the newly exported PSE is actually loaded – Key Storage changes don’t take effect for existing connections until this happens.
Step 6: Verify the certificate is live
Open https://<host>:5<NN>01/nwa (or whichever HTTPS port you’re using) in a browser and check the padlock – confirm the issuer and expiry match what you just imported.
What’s next
A manual Key Storage import gets you sorted today, but under SC-081’s shortening lifetimes this becomes a several-times-a-year job per system unless it’s automated. Our guide to automating NetWeaver AS Java certificate renewal covers setting that up through SAP Secure Login Server’s CLM (Certificate Lifecycle Management) application, so this is the last one you do by hand. If something didn’t go to plan, our troubleshooting guide covers the errors we see most often here.