Skip to main content

SAP ECC / SAP NetWeaver requirements

SAP systems often require additional configuration to support modern TLS and external APIs.

Required configuration​

  1. Enable Server Name Indication (SNI)

    Required to ensure the correct TLS certificate is selected on Cloudflare’s edge for multi-tenant HTTPS routing.

    SAP parameter: icm/HTTPS/client_sni_enabled = TRUE

  2. Enable TLS v1.2 or higher

    Ensure ssl/client_ciphersuites is configured to support TLS 1.2+ compatible cipher suites (as per SAP kernel version).

  3. Ensure the SAP STRUST store contains all required public root CAs used by modern TLS services.

    Import all required root certificates into both:

    • SSL Client (Anonymous)
    • SSL Client (Standard)
    note

    SAP STRUST is independent of the operating system trust store and must be maintained separately.

Root certificates (trust store)​

Certificate AuthorityRoot NameDownload
Google Trust ServicesGTS Root R1https://i.pki.goog/r1.pem
Google Trust ServicesGTS Root R2https://i.pki.goog/r2.pem
Google Trust ServicesGTS Root R3https://i.pki.goog/r3.pem
Google Trust ServicesGTS Root R4https://i.pki.goog/r4.pem
Let’s EncryptISRG Root X1https://letsencrypt.org/certs/isrgrootx1.pem
SSL.comTLS RSA Root CA 2022https://ssl.com/repo/certs/SSLcom-TLS-Root-2022-RSA.pem
SSL.comTLS ECC Root CA 2022https://ssl.com/repo/certs/SSLcom-TLS-Root-2022-ECC.pem

Connectivity test endpoints​

PurposeURL
Fluentax API TLS validation endpointhttps://fx-api.fluentax.com/healthz/live
GTS Root R1 TLS validation endpointhttps://good.gtsr1.demosite.pki.goog
GTS Root R2 TLS validation endpointhttps://good.gtsr2.demosite.pki.goog
GTS Root R3 TLS validation endpointhttps://good.gtsr3.demosite.pki.goog
GTS Root R4 TLS validation endpointhttps://good.gtsr4.demosite.pki.goog
ISRG Root X1 TLS validation endpointhttps://valid-isrgrootx1.letsencrypt.org
SSL.com TLS RSA Root CA 2022 TLS validation endpointhttps://test-root-2022-rsa.ssl.com
SSL.com TLS ECC Root CA 2022 TLS validation endpointhttps://test-root-2022-ecc.ssl.com
tip

You can use report RSHTTP20 with destination SAPHTTPA to test the connection to the test endpoints above.

Troubleshooting​

Common errors​

  • SSL handshake failed
  • SSSLERR_SERVER_CERT_MISMATCH
  • ICM_HTTP_SSL_ERROR
  • unknown CA
  • peer certificate unknown
  • no SNI match
  1. Test via SAP transaction
  • SMICM → Goto → Trace File
  • Report: RSHTTP20

  1. Enable ICM trace (if needed)

    Trace level = 3

  2. Check certificates in STRUST

  • SSL Client (Anonymous)
  • SSL Client (Standard)
  1. External TLS test
openssl s_client -connect fx-api.fluentax.com:443 -servername fx-api.fluentax.com

Common root causes​

  • Missing root CA in STRUST
  • SNI not enabled in SAP profile
  • TLS < 1.2 enforced
  • Corporate proxy or SSL inspection modifying TLS traffic or certificates
note

Note: TLS handshake failures may appear as HTTP timeouts in SAP logs depending on configuration.