XS/Cockpit URLs SSL certificates are not updated after HANA DB SSL Certificate renewal

Problem: XS URLs  SSL certificates are not updated after HANA DB SSL Certificate renewal

Cause: 

AP HANA 2.0 Cockpit is based on SAP HANA XS Advanced (XSA) which handles certificates a bit different than the former XS classic implementation.

The XSA SSL certification is sometimes overwritten with a new installation/update.

Solution:

You need to bundle the certificate chain and import it to the XSA cert path.

Export certificates for XSA

sapgenpse export_p12 -p cockpithttps.pse -C 0 cockpithttps.p12

Export private key, certificate and CA chain & combine certificate and CA chain into 1 file.

1. openssl pkcs12 -in cockpithttps.p12 -nocerts -nodes | sed -ne '/-BEGIN PRIVATE KEY-/,/-END PRIVATE KEY-/p' > privatekey.key
2. openssl pkcs12 -in cockpithttps.p12 -clcerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > certificate.pem
3. openssl pkcs12 -in cockpithttps.p12 -cacerts -nokeys | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cachain.pem
4. cat certificate.pem cachain.pem > combinedcerts.pem
5. openssl pkcs8 -topk8 -in privatekey.key -out private_pkcs8.key -nocrypt

Implement private key and combined certificate file to XSA

1. xs set-certificate <DOMAIN> -c combinedcerts.pem -k private_pkcs8.key
2. XSA restart

(( Get the domain from commands : xs domains ))

Opening the Cockpit URL should now change to new SSL Certs