How to Install an SSL/TLS Certificate on SAP Web Dispatcher (Linux & Windows)

The SAP Web Dispatcher usually sits at the edge of your landscape, which means its SSL/TLS certificate is the one that has to keep working without a fuss. This guide walks through installing a certificate on it from scratch – generating the request, getting it signed, importing it, and activating it without taking the Web Dispatcher down. The steps are the same whether you’re on Linux/Unix or Windows; where the two differ, we’ve called it out.

One thing worth knowing before you start: under the CA/Browser Forum’s SC-081 ruling, public certificate lifetimes are shrinking on a fixed schedule (200 days from March 2026, 100 days from March 2027, 47 days from March 2029). A manual install like this one is fine to do once, but it’s worth reading this alongside our guide to automating Web Dispatcher certificate renewal, since you’ll be doing this more often than you used to.

Before you start

  • Shell or RDP access to the Web Dispatcher host, with rights to run sapgenpse (typically the <sid>adm user on Linux/Unix, or an equivalent admin account on Windows).
  • The PSE’s PIN (if one already exists), or the ability to set one for a new PSE.
  • Your SECUDIR location. This is usually the instance’s sec directory (for example /usr/sap/<SID>/SYS/global/security/data on Linux/Unix, or \usr\sap\<SID>\SYS\global\security\data on Windows) – confirm it in your Web Dispatcher’s profile if you’re not sure, since it can be set per-instance.
  • Outbound access from the host to your certificate authority, if you’re generating the CSR there.
  • A maintenance window is not required for this – the whole point of the steps below is that Web Dispatcher picks the new certificate up without a restart.

Step 1: Locate your PSE and generate a CSR

Web Dispatcher’s server certificate lives in a PSE (Personal Security Environment) file called SAPSSLS.pse, in your SECUDIR. If this is a first-time setup and the file doesn’t exist yet, create it and generate a certificate signing request in the same step:

sapgenpse gen_pse -p SAPSSLS.pse -r csr_webdispatcher.p10 "CN=webdisp.yourdomain.com, OU=IT, O=Your Company, C=GB"

You’ll be prompted to set a PIN for the PSE – keep this somewhere safe, you’ll need it again in Step 3 and Step 4. The command above writes the CSR out to csr_webdispatcher.p10, ready for the next step.

If a PSE already exists and you’re just renewing into the same file, you can generate a fresh CSR against it instead of creating a new PSE from scratch – worth checking your current PSE’s contents first with sapgenpse maintain_pk -l -p SAPSSLS.pse so you don’t overwrite something you meant to keep.

Step 2: Get the CSR signed

Submit csr_webdispatcher.p10 to your certificate authority. If you haven’t got a certificate lined up yet, you can browse and buy SSL certificates directly – it saves a separate vendor account and back-and-forth quoting. You’ll get back a signed certificate and, separately, the CA’s intermediate and root certificates (or a full chain bundle).

Step 3: Import the signed certificate and CA chain

Before importing, combine the intermediate and root certificates into a single chain file, intermediate first, then root:

cat intermediate.crt root.crt > ca_chain.crt

Then import the signed certificate and the chain into the PSE:

sapgenpse import_own_cert -p SAPSSLS.pse -c webdispatcher_cert.crt -r ca_chain.crt -x <PIN>

-c is the signed certificate you got back from the CA, -r is the chain file from above, and -x is the PIN you set in Step 1. Run the maintain_pk -l command again afterwards to confirm the full chain is showing in the PSE, not just the leaf certificate – a common mistake here is importing the certificate without the chain, which leaves browsers unable to verify it.

Step 4: Add an SSO credential so Web Dispatcher can read the PSE

Web Dispatcher needs to open the PSE at startup and on reload without a human typing the PIN in. That’s what seclogin is for – it stores a credential on the host (readable only by the appropriate OS user) so the PSE unlocks automatically:

sapgenpse seclogin -p SAPSSLS.pse -x <PIN> -O <sidadm_user>

Without this step, Web Dispatcher can fail to start – or fail to pick up the new certificate on reload – because it can’t unlock the PSE on its own.

Step 5: Activate the certificate without downtime

This is where Linux/Unix and Windows genuinely diverge:

  • Linux/Unix: send the Web Dispatcher process a HUP signal, which tells it to re-read its profile and reload the PSE in place, with no dropped connections: kill -HUP <web_dispatcher_pid>. This is the standard SAP BASIS convention for a “soft reload” and applies to several other SAP processes too, not just Web Dispatcher.
  • Windows: Windows services don’t support POSIX signals, so the equivalent is either a service restart via sapcontrol -nr <instance_number> -function RestartService, or triggering a reload from the Web Dispatcher’s own admin interface (see below) rather than the OS service layer.

On either OS, you can also reload from Web Dispatcher’s built-in admin interface, normally reachable at http(s)://<host>:<admin_port>/sap/wdisp/admin – it has an option to reload the SSL configuration without a restart, which is a useful OS-agnostic fallback if you’d rather not touch the command line, or if you’re not sure of the process ID.

Step 6: Verify the certificate is live

Check the certificate a browser actually sees – click the padlock on your Web Dispatcher’s HTTPS URL and confirm the expiry date and issuer match what you just imported. It’s worth checking this from outside your network too, in case an old certificate is still cached at a load balancer or CDN in front of Web Dispatcher. If something looks wrong, SAP Notes 2937709 (SSL configuration and troubleshooting) and 3749778 (false expiry alerts after a reload) are good starting points before assuming the import itself failed.

What’s next

A one-off install like this gets you sorted for now, but under SC-081’s shortening lifetimes you’ll be back here every few months unless this is automated. Our guide to automating Web Dispatcher certificate renewal covers exactly that – so this is genuinely the last time you do it by hand. If something didn’t go to plan, our troubleshooting guide covers the errors we see most often here.