Certificate management
Keeping the certificates a system trusts and presents over TLS current: importing root and intermediate CAs, requesting and importing its own signed certificate, and replacing one before it expires. Storing and rotating passwords and keys an application reads is secrets rotationSecrets rotationRotating credentials a running service depends on — service keys, destination credentials, API tokens — without downtime and without redeploying. Distinct from storing secrets, which the platform handles.SAP only.
Overview
The Trust Manager, transaction STRUST, generates key pairs, creates certificate requests for a CA to sign and maintains the list of trusted CAs a server accepts.
Not covered: At maintenance in the transaction. SAP's page describes no warning for a certificate close to expiry and no update of the trusted CAs from a published list.
abapPM/ABAP-StrustabapPM/ABAP-StrustA class-based wrapper around ABAP Trust Management (STRUST) for adding, updating, removing and listing certificates from a program, with installer and updater programs for the certificates a domain needs.independent, abap wraps STRUST in a class a program can call, and zstrustzstrustA tool that updates the root certificate authorities in an SAP NetWeaver server from Mozilla's certificate store, checking first that each certificate is valid and not already on the system.independent, abap updates the root CAs from Mozilla's certificate store. Both work on the PSEs STRUST maintains; how they relate to it has not been assessed.
On BTP the certificates in question are the client and trust certificates a destination uses when it calls another system, kept with the destination in SAP Destination serviceSAP Destination serviceNamed, credentialed addresses of other systems, resolved at runtime — so an application holds no URL and no secret of its own, and the same code reaches a different system in every landscape.sap official, btp.
The Destination service uploads, generates, views and deletes certificates for destinations from JKS, PFX, PEM, CER, CRT and P12 files, and renews a generated certificate automatically near expiry when that option is set. SAP also publishes the BTP Trust Store, the root CA certificates BTP uses, for clients to update regularly.
Not covered: An uploaded certificate cannot be renewed automatically, so a client certificate issued outside BTP is replaced by hand before it expires.
The certificate a public domain is served with is held by SAP Custom Domain ServiceSAP Custom Domain ServiceExposes a BTP application publicly under the customer's own domain instead of the default subdomain, with the TLS/SSL certificate and TLS configuration that domain is served with.sap official, btp, which is SAP's own and sits beside the Destination service.
No community artifact is documented here.
Artifacts
Details
Coverage
For your agent
- Ref
capability:certificate-management- JSON
- /capabilities/certificate-management.json
- MCP
- Connecting an agent