3055796 - SSL 3rd-Party Scans & Vulnerabilities

 Penetration or third-party security scans (e.g., Tenable Nessus, Qualys, or equivalent VA tools) flag a series of SSL/TLS vulnerabilities on SAP NetWeaver Application Server ABAP, suggesting that the system's security configuration is either weak or insufficient to protect against current threats. 

Questions might be:

• Is my system vulnerable due to these alerts?
• Must there be changes made?

Scanner findings may include SSL Certificate Cannot Be Trusted, where the certificate chain presented on SAP internal communication ports is signed by an unknown or unrecognized Certificate Authority. This commonly occurs when the SAP System PKI auto-generated certificate (OnTheFlyInstancePSE, issued by C=DE/O=SAP System PKI/OU=sapstartsrv/CN=root_PRT) is in use, as this internal Root CA is not registered in the scanner's trusted CA store.

SAP NetWeaver Application Server ABAP

SSL, TLS, nessus, BEAST, birthday, 3DES_EDE_CBC, RC4, weak cipher, vulnerability , KBA , BC-SEC-SSL , Secure Sockets Layer Protocol , BC-CST-STS , Startup Service , How To