Automate SAP Certificate Management

While a two-year standard (825 days) was the norm until 2018, Apple cut this to 398 days in 2020. Upcoming CA/B Forum mandates will slash maximum lifespans to just 100 days by 2027, and down to a mere 47 days by 2029. This means renewal cycles are accelerating by a factor of 8—making manual processes impossible to scale.

This exponential increase in manual effort forces Basis teams to repeatedly request, distribute, and activate certificates across numerous SAP systems. The risk of downtime skyrockets, as expired certificates immediately halt interfaces, RFC connections, and productive dialogs. In heterogeneous landscapes (ABAP PSEs, Java Keystores, HANA, Host Agent, Cloud Connector, BTP, RISE), there is often zero transparency. Nobody knows which certificates are valid and where until it’s too late—and each certificate requires a different procedure to replace.

We built the next generation of our solution based on a clear demand from our customers: "We want to spend as little time as possible managing certificates." EPOS transforms a reactive emergency response into a proactive, highly automated routine.

Core Benefits at a Glance:

- Proactive monitoring & alerting: Maintain full visibility of all PSE and SSL certificates and receive automated alerts before situations become critical.

- Automated renewal: Request, validate, and deploy new certificates at the push of a button - or schedule them entirely hands-free.

- Centralized management: Check, replace, and remove certificates across your entire SAP landscape from a single, intuitive interface.

- Best-practice processes: Leverage proven, secure processes to significantly reduce operational costs and time spent on manual tasks.

- EPOS as the Central Point of (Certificate) Management: EPOS acts as the central hub for your entire SAP environment. It connects to internal and public CAs (e.g., Microsoft ADCS) via standard protocols (ACME, EST, CMP, ADCS, Manual) and distributes certificates to SAP On-Prem/Core (ABAP/PSE, Java Stack, HANA, Host Agent, TREX, Web Dispatcher). In the next release, this functionality will expand to SAP BTP/Cloud (Custom Domains, Destinations, Cloud Connector, Integration Suite).

A major highlight of the new release is the fully automated renewal workflow. The entire process runs without manual intervention:

1. Request: The integrated ACME client in EPOS sends a certificate signing request to your Certificate Authority (CA), such as Let's Encrypt.

2. Validation: Domain control is automatically verified (e.g., via HTTP-01 or DNS-01 challenges).

3. Installation: Upon successful validation, the CA returns the signed certificate, and EPOS installs it directly into the target system. This entire workflow can be triggered via cron job or timer.

1. Request: Application via API

2. Issue: CA issues the certificate

3. Deploy: Distribution into SAP

4. Activate: System-level activation

5. Renew: Automated renewal prior to expiration

1. Mode: Select process mode

2. Certificate Selection: Select certificates

3. Action Definition: Define the action (e.g. renewal)

4. Config Review: Verify configuration

5. Execute: Securely run the process

All Certificates in One View: Automated scanning (On-Prem, Cloud & ECS – captured cyclically).

- Central Inventory: Server, Client, and Root certificates consolidated.

- Total Transparency: Unprecedented visibility across the entire SAP landscape.

- Monitoring & Rotation: Automated for the SAP-controlled footprint.

- Alerts & Notifications: Early warnings before expiration—delivered via email or API.

- Reporting: Exportable, audit-ready compliance reports.

- Certificate Metadata: Manage Certificate Owners, Trust Chains, and Compliance. (Available in the next release)

- Audit Trail: Comprehensive logging of every change.

We continuously evolve our solutions to prepare you for upcoming challenges. The roadmap for the SAP Certificate Management solution includes:

RISE with SAP: The solution is already largely "RISE-Ready" and is continuously being adapte

Non-SAP systems: Planned expansion to manage certificates for non-SAP systems.

Availability of the new version planned for Q2 2026.