2533915 - SAP SuccessFactors SSL Certificate Renewal Schedule and Public Certificate Repository

In our ongoing efforts to build and manage transparency with our customers, we are happy to publish our SSL certificate life-cycle in advance to enable your environment with the latest secured SSL certificates. This KB article will be used to consolidate and publish all SSL certificates with their tentative deployment date and public certificate download links. This article also contains an FAQ section with relevant information on this topic. It's highly recommend you read the FAQ section before opening a Support case.

SSL Certificate Renewal Notifications will be published 45 and 30 days prior to the certificate expiration date to remind you of the “call to action”. Be advised we will initiate the deployment process around 15 days prior to the certificate expiration date. The certificate will be made available here only 28-30 days prior to expiration. You will receive a final notification 7 days prior to the deployment of the certificate. You're encouraged to bookmark this KB article. If you are not familiar with making the required changes, please notify your company's internal IT department and request for the changes to be made as soon as possible

SAP SuccessFactors HXM Suite

Schedule for Updating the SSL Certificates:

Frequently Asked Questions:

Q: How do I know if I am impacted by the certificate renewal?

A: You will be impacted by the certificate renewal activity, only if:

• You are using our APIs (SFAPI/Odata API/Adhoc API) and have some integration scenario setup for your SFSF Instance.
• You can find list of API URLs for all datacenter HERE
• You are using some middleware (eg: SAP CPI/HCI/PI/PO/XI or Dell Boomi) for integration setup. Note that for CPI, if you already have SuccessFactors' root certificate installed in your tenant, you won't be impacted.
• For Boomi, if you are using the SFSF Hosted Cloud atom of the same DC where your instance resides, you need not make any changes. However, if you are using a local atom/Dell Atom Cloud in Boomi to connect to our APIs, you may need to upload the certificates in Boomi.
• The Successfators API domain for which the certificate is being renewed (Eg: *.successfactors.eu) is same as the domain you are using to access/connect to Successfactors API server using API URL as the endpoint URL.
• Check KB article 2509971 - FAQs on the impact of SuccessFactors Certificate Renewal if you use APIs (SFAPI/OData API/adHoc API) for more detail.

Q: If I pin the new certificate Do I need to install the intermediate certificate?

A: Yes, if this is the first time installing a certificate. Navigate to the Attachments section and download the "DigiCertCA_Chain_2020.cer" or "DigiCertCA_Chain_Jun2021.cer" and install the new Intermediate. All certificates with a validity date starting after June 9 2021 will use the "DigiCertCA_Chain_Jun2021.cer" chain.

NOTE: a new intermediate cert was included Feb 2021 as it was updated at the end of 2020 by the CA. This was updated again June 9th 2021 without warning. It was included here after communication from the CA on June 15.

Q: Why do I need to install the intermediate certificate?

A: When installing a Digicert SSL certificate, it is essential to install the correct Intermediate CA at the same time as the SSL certificate. This ensures that the SSL certificate is fully trusted by all browsers and client computers which prevents errors from appearing when users visit a secure website.

Q: How do I download or install the certificate?

A: You must have admin access to the server where you need to install the certificate. If you do not have access to your company's SSL server, notify your IT team and provide them the respective certificate download link from the above table. For SuccessFactors certificates in CPI landscape, you can follow KBA  2776681 - How to maintain SuccessFactors certificates in CPI landscape - Cloud Platform Integration”

Q: I notice a discrepancy in the validity start date and end date mentioned in this knowledge article table and my downloaded certificate. What does this indicate?

A: Sometimes, due to time zone difference, you may see a different date in the downloaded certificate. There is no impact on the certificate update activity due to this. You will be renewing the certificate well in advance, before the certificate expiry date. You will receive a final notification 7 days prior to the deployment of the certificate.

Q: When should I renew the certificates?

A: It is recommended to renew the certificates soon after they are available. Note that you can maintain both the "old" certificate and the new one at the same time on your middleware storage. This way you won't face any issues when the change occur. However, please note the "old" certificate should only be removed after the Tentative Deployment date of the certificate as per the above table and as per date informed in the e-mail notification you receive.

Q: Why does the new certificate appear in the following year list?

A: On the day it is renewed it is added to the following year list and the old certificate is removed from the current year list. We only want to have a single certificate available for download at any given time.

Q: Certificate "successfactors.com2021.cer" is not attached. Where can I download it?

A: Our internal resources have confirmed that you can use the "successfactors.com2022.cer" certificate.

Q: Where do the certificates get applied and who performs the update?
A: The certificate updates are applied on your third-party servers, see image below and this is done by those servers's admins which is generally deferred to the customer's IT.

Q: What if my system is not in the domain of the certificate being renewed?
A: For the following domains:

   SAPSF.EU
   SAPSF.COM
   SUCCESSFACTORS.EU
   SUCCESSFACTORS.COM

It is possible to have instances in multiple of these domains. Example: Communication for sapsf.eu contains instance with sapsf.eu and successfactors.eu. In this case there is no action needed for the successfactors.eu instance.

Note: The SSL certificate renewal does not impact the BizX SSO certificate.

Communications specific to the following domains: *.sapsf.cn / *.sapsf.com / *.sapsf.eu / *.successfactors.com / *.successfactors.eu  
Q1: I have received a Part 1 of 2 and/or Part 2 of 2 communication in relation to certificate renewals – why is this and do I need to install both?
A1: This is a short-term measure due to an internal change in the SAP SuccessFactors Network. Until further notice, both certificates are required.

Q2: Will the customer still get the 45 days advanced notice communication?
A2: Yes. Customers can still expect 45 days advance notice followed by a reminder 2 weeks before the certificate deployment and a final reminder 7 days/week before certificate deployment.

Q3: Will the certificate deployment process change?
A3: No. The process remains the same as for previous certificates, the only change is that, until further notice, there will be two certificates to install (1 of 2 and 2 of 2).

Q4: How will these part 1 of 2 and 2 of 2 be reflected in the above schedule?
A4: Please expect the following format and naming convention (*dates and domain are used for illustration purposes only*):

SF, success factors, BizX, biz x, cloud, PLT, platform, certificate , KBA , LOD-SF-PLT-PSI , Product Security Inquiries , LOD-SF-INT , Integrations , LOD-SF-LMS , Learning Management System , How To