{"ref":"capability:certificate-management","page":"/capabilities/certificate-management","json":"/capabilities/certificate-management.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"certificate-management","name":"Certificate management","domain":"security-and-compliance","ecosystems":["abap","btp"],"universal":false,"description":"Keeping the certificates a system trusts and presents over TLS current: importing root and intermediate CAs, requesting and importing its own signed certificate, and replacing one before it expires. Storing and rotating passwords and keys an application reads is [secrets rotation](capability:secrets-rotation).","short":"Keeping trusted and presented TLS certificates current","core_coverage":{"state":"core-and-community","assessed_at":"2026-09-14","what_core_does":"The Trust Manager, transaction STRUST, generates key pairs, creates certificate requests for a CA to sign and maintains the list of trusted CAs a server accepts.","where_it_stops":"At maintenance in the transaction. SAP's page describes no warning for a certificate close to expiry and no update of the trusted CAs from a published list.","sources":[{"url":"https://help.sap.com/doc/saphelp_nw74/7.4.16/en-us/4c/5b218c980a7514e10000000a42189b/content.htm?no_cache=true","title":"SAP Help, SAP NetWeaver 7.4: Getting Started with the Trust Manager","checked":"2026-09-14","quote":"The trust manager performs certificate maintenance functions such as generating key pairs, creating certificate requests to be signed by a certification authority (CA), and maintaining the list of trusted CAs that the server accepts."}],"relationship":"unassessed","note":"[abapPM/ABAP-Strust](artifact:abappm-abap-strust) wraps STRUST in a class a program can call, and [zstrust](artifact:mkysoft-zstrust) updates the root CAs from Mozilla's certificate store. Both work on the PSEs STRUST maintains; how they relate to it has not been assessed."},"coverage_by_ecosystem":{"btp":{"state":"core-only","assessed_at":"2026-09-14","what_core_does":"The Destination service uploads, generates, views and deletes certificates for destinations from JKS, PFX, PEM, CER, CRT and P12 files, and renews a generated certificate automatically near expiry when that option is set. SAP also publishes the BTP Trust Store, the root CA certificates BTP uses, for clients to update regularly.","where_it_stops":"An uploaded certificate cannot be renewed automatically, so a client certificate issued outside BTP is replaced by hand before it expires.","sources":[{"url":"https://github.com/SAP-docs/btp-connectivity/blob/main/docs/1-connectivity-documentation/manage-destination-certificates-df1bb55.md","title":"SAP-docs/btp-connectivity: Managing Destination Certificates","checked":"2026-09-14","quote":"Certificates added through the Upload Certificate option cannot be automatically renewed."},{"url":"https://github.com/sap-software/btp-trust-store","title":"sap-software/btp-trust-store","checked":"2026-09-14","quote":"a list of trusted X.509 certificates of Root Certificate Authorities that are used by BTP"}],"note":"The certificate a public domain is served with is held by [SAP Custom Domain Service](artifact:btp-custom-domain), which is SAP's own and sits beside the Destination service."}},"framing_by_ecosystem":{"btp":{"description":"On BTP the certificates in question are the client and trust certificates a destination uses when it calls another system, kept with the destination in [SAP Destination service](artifact:btp-destination)."}},"drafted_with_ai":true,"history":[{"date":"2026-10-26","field":"core_coverage.note","from":"Both community entries work on the PSEs STRUST maintains; how they relate to it has not been assessed.","to":"Names the two kinds (a class wrapper around STRUST, a root CA updater) with links, and drops the count.","reason":"Reassessed against the graph (check:capabilities): the note counted providers."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.note","from":"No community entry answers the concern on BTP, so core-only is a assessment of the corpus.","to":"The certificate a public domain is served with is held by SAP Custom Domain Service, which is SAP's own and sits beside the Destination service.","reason":"Reassessed against the graph (check:capabilities): the note was an absence claim about providers; the new SAP provider btp-custom-domain is sap-official, so core-only still holds."}]},"sap_delivery":{"door":"abap","all":null,"by_flavor":{"standard-abap":null,"abap-cloud":null}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:abappm-abap-strust","name":"abapPM/ABAP-Strust","json":"/artifacts/abappm-abap-strust.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:btp-custom-domain","name":"SAP Custom Domain Service","json":"/artifacts/btp-custom-domain.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:mkysoft-zstrust","name":"zstrust","json":"/artifacts/mkysoft-zstrust.json","ecosystem":"abap","origin_ring":"independent"}],"samples":[],"explained_by":[],"normative_context":[]}}