abapPM/ABAP-Strust

Trust Management

Easy-to-use class for adding, updating, or removing certificates from ABAP Trust Management (transaction STRUST)

NO WARRANTIES, MIT License

Usage

Install Certificates

Run program /APMG/STRUST_INSTALLER and enter the domain for which you want to install the required certificates to ABAP Trust Management:

Update Certificates

Run program /APMG/STRUST_UPDATER and optionally enter domains for which you want to update the certificates to ABAP Trust Management:

API

Example of creating, updating, or removing a certificate using class /apmg/cl_strust.

CONSTANTS:
  c_sslc    TYPE psecontext VALUE 'SSLC' ##NO_TEXT,
  c_anonym  TYPE ssfappl VALUE 'ANONYM' ##NO_TEXT,
  c_id      TYPE ssfid VALUE 'CN=%SID SSL client SSL Client (Standard), OU=%ORG, O=MBT, C=CA' ##NO_TEXT,
  c_org     TYPE string VALUE 'Marc Bernard Tools' ##NO_TEXT,
  c_subject TYPE string VALUE 'CN=*.marcbernardtools.com' ##NO_TEXT.

DATA(strust) = /apmg/cl_strust=>create(
  context     = c_sslc
  application = c_anonym ).

strust->load(
  create = abap_true
  id     = c_id
  org    = c_org ).

strust->get_own_certificate( ).

strust->get_certificate_list( ).

IF drop = abap_true.
  strust->remove( c_subject ).
ELSE.
  strust->add_pem( '<your_certificate>' ).
  DATA(result) = strust->update( ).
  " result-added contains newly added certificates
  " result-removed contains removed certificates (if remove_expired = abap_true)
ENDIF.

The certificate for the add method needs to be provided as a table with the following format:

-----BEGIN CERTIFICATE-----
MIIGQDCCBSigAwIBAgIQCNqWSvYNNa9hfOzsk89rUjANBgkqhkiG9w0BAQsFADBg
MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
...
-----END CERTIFICATE-----

Alternatively, use the method add_pem to pass the certificate as a string.

SSL Server Certificate Request and Response

Generate a certificate request for signing (CSR) using the following method. Optionally, pass a list of identifiers (DNS-SAN):

DATA(strust) = /apmg/cl_strust=>create(
  context     = /apmg/cl_strust=>c_context-ssls
  application = /apmg/cl_strust=>c_application-dfault ).

DATA(signing_request) = strust->generate_certificate_request( identifiers ).

Import a signed certificate chain (PEM) into the SSL Server:

DATA(strust) = /apmg/cl_strust=>create(
  context     = /apmg/cl_strust=>c_context-ssls
  application = /apmg/cl_strust=>c_application-dfault ).

strust->load( )->import_certificate_response( signed_response ).

The method stores and distributes the certificate notifying Internet Connection Manager (ICM).

Prerequisites

• SAP Basis 7.50 or higher
• Packages:
  • ajson
  • exeptions
  • distinguished-name

Installation

Install strust as a global module in your system using apm.

or

Specify the strust module as a dependency in your project and import it to your namespace using apm.

Contributions

All contributions are welcome! Read our Contribution Guidelines, fork this repo, and create a pull request.

You can install the developer version of ABAP STRUST using abapGit by creating a new online repository for https://github.com/abapPM/ABAP-Strust.

Recommended SAP package: /APMG/STRUST

About

Made with ❤ in Canada

Copyright 2025 apm.to Inc. https://apm.to

Follow @marcf.be on Bluesky and @marcfbe or LinkedIn