The next decision you have to make is where to terminate SSL. If you choose to support SSL in all involved SAP systems, the undertaking is considerable. Most customers choose to terminate SSL in either a hardware or software proxy, such as the Web Dispatcher, for the very reason. Instead of having to maintain tens or hundreds of certificates, you will maintain the certificates only on the reverse proxy. There are many blogs and documents on SCN on how to setup SSL for various SAP products so no need to repeat the information here. One take away I have for you is that even if you terminate SSL in a reverse proxy, most SAP systems still need additional configuration steps so that correct URLs will be generated, URLs that point to the reverse proxy instead of the SAP system itself (see HTTPURLLOC and ProxyMapping for details). At least AS JAVA and AS ABAP both require that you to enable HTTPS even if HTTPS is terminated in a reverse proxy, otherwise HTTPS URLs can't be generated.
↧