If you followed our NetWeaver AS Java / PI-PO installation guide, your certificate is live. This guide covers automating renewal through SAP Secure Login Server’s CLM (Certificate Lifecycle Management) application – the Java-stack equivalent of the SSF_CERT_ENROLL/SSF_CERT_RENEW jobs we covered for ABAP systems, and sapslscli for Web Dispatcher.
What you need before you start
- SAP Secure Login Server 3.0 or later, deployed to your Java system as an SCA (via the telnet deployment tool) – it’s a separate, licensed SAP product.
- Once deployed, the CLM application is reachable at
https://<host>:<port>/sapsso/clm. - In NWA, under Configuration → Certificates and Keys → Security → Permissions by Domain, the CLM application needs to be granted full access to whichever keystore views you want it managing renewal for.
Step 1: Register the system with CLM
Open the CLM application and enter the metadata URL for your Secure Login Server, then click Fetch. After authenticating, choose Register, then Save. This is a one-time step per system, not something you repeat on a schedule.
Step 2: Enroll the certificates you want managed
In the Enrollment tile, select the keystore view and certificate entry – for a typical PI/PO or AS Java system, that’s the ssl-credentials entry from the installation guide. Choose Enroll Certificates, review the details CLM retrieves, and confirm.
Step 3: Schedule automatic renewal
CLM lets you create a scheduled task so future renewals happen without manual intervention. One detail worth knowing before you set this up: the scheduled task runs under whichever user is logged in when it’s created – it isn’t inherently a service-account job the way a cron entry or an ABAP background job is. Use a dedicated technical user for this rather than a named admin’s own login, or a renewal can silently stop working the day that person’s account is disabled or their password changes.
Step 4: Don’t skip the activation step
As in the manual install, a renewed certificate sitting in Key Storage isn’t the same as a renewed certificate the ICM is actually using. Whether CLM’s automation handles the Export View to PSE and SSL Provider restart for you, or whether you need to trigger that separately, is worth confirming directly in your environment before you trust the automation completely – this is exactly the kind of step that’s easy to get right once, manually, and then miss when it’s supposed to happen unattended.
Where this leaves you
Set up and verified end to end, this is the last certificate you import into NWA’s Key Storage by hand for this system. Given how much more often SC-081 will make this necessary, that upfront CLM configuration pays for itself quickly if you’re running more than one Java system. If the automation isn’t behaving as expected, our troubleshooting guide covers the errors we see most often.