SAP Knowledge Base Article - Public

3132570 - Domain certificate renewal for SAP Cloud for Customer URLs (*.crm.ondemand.com) at Akamai

Symptom

Background

The existing server certificate for domain “*.crm.ondemand.com” is being renewed at Akamai as it will get expired on January 25th 2022.

Moscow Tenant : Change Schedule : January 14th 2022 SAT 22:00 UTC till SUN 02:00 UTC - 15th Jan 2022 - (Customer Test and Production).

Rest of the World : Change Schedule: January 14th 2022 SAT 22:00 UTC till SUN 02:00 UTC - 15th Jan 2022- (Customer Test and Production).

Download New Certificate(*.crm.ondemand.com) from the Attachment section.

Environment

SAP Cloud for Customer

Resolution

Action Required

If you have third party integrations like web services/APIs in your SAP Cloud for Customer tenant, you may be required to update the domain certificate. These updates should be conducted by your internal IT resources, with the new certificate information as below.

Impact on your tenant depends on the CDN configuration. For more details refer the FAQs section.

NOTE: Issuer Certificates-Root and Intermediate certificate of *.crm.ondemand.com remains unchanged .

FAQ's

What changes or adoption are required from customer side?

As described already, you need to take action based on the CDN configuration of your tenant.

  • C4C URL's that are Akamai IPA enabled or Non-Akamai: No action required
  • C4C URL's that are Akamai ION enabled: You may be required to update the domain certificate with the help of your internal IT resources if you have third party integrations like web services/APIs in your Cloud for Customer tenant

How to identify your SAP Cloud for Customer tenant’s CDN configuration?

Below are the configurations available:

Akamai ION: If your SAP Cloud for Customer URL is AKAMAI Ion enabled, output of the below mentioned command should look like as follows: 

Name: e9343.a.akamaiedge.net 

Address: 104.98.170.64 

Aliases: myXXXXXX.crm.ondemand.com 

mow1.crm.ondemand.com.edgekey.net – Moscow tenants

row1.crm.ondemand.com.edgekey.net – Rest of the world tenants

  • Please note that if the string *akamaiedge* is present in the results, then it means the URL is Akamai Ion enabled.

Akamai IPA (mainly relevant for tenants w/ EUDP contract): If your SAP Cloud for Customer URL is AKAMAI IPA enabled then output of the below mentioned command should look like as follows: 

Non-Akamai: If your SAP Cloud for Customer URL does not show outputs like above two configurations and if the command nslookup myXXXXXX.crm.ondemand.com shows below result as Non-authoritative answer: Name: wd-XXX-X.crm.ondemand.com - this means your tenant is not connected through Akamai and directly hitting the origin.

What are these certificates used for?

These certificates are used for the SSL/TLS handshake that any system using the 'secure' protocol does before allowing connection to/from the system. In our case, SAP Cloud for Customer uses the 'secure' HTTPS protocol and hence the SSL handshake is must for any system to connect to these URLs.

How do we test the new certificate?

The change is at Akamai platform and the renewal happens for both customer test and production tenants at the same time. You can still test the new certificate by following below steps.

You would see output like below

Name:    e9343.a.akamaiedge-staging.net

Address:  23.201.233.6

Aliases:  [X]ow1.crm.ondemand.com.edgekey-staging.net

  • Copy the IP address you have got in step above 
  • Open the path C:\Windows\System32\drivers\etc
  • Edit the host file with the IP assigned to your tenant URL(like sample IPs below)

23.201.233.6  myXXXXXX.crm.ondemand.com

23.201.233.6 myXXXXXX-sso.crm.ondemand.com

  • After making changes save the file and restart your machine to apply the new changes 

Are the new certificates known to modern web browsers?

DigiCert Root Certificates are automatically recognized by all common web browsers, mobile devices, and mail clients. Therefore no change is required for browsers. The same is true if one relies on the standard sapjvm trust list.

The CA root certificate is included in:

  • SAP JVM patch level 8.1.035 or 7.1.054
  • Cloud Foundry buildpack SAP-Java (sap_java_buildpack) version 1.6.15

How do I download or install the certificate?

You must have admin access to the server where you need to install the certificate. If you do not have access to your company's SSL server, notify your IT team and provide them the respective certificate download link from the above table.

How do Import Single Certificate in SAP CPI Key Store?

Follow the steps mentioned in the link.

How to check the certificate in my browser trust list?

Google Chrome:

  • Open settings in chrome browser and search for security in the search box and click on it.

Image4.png

  • Go to manage certificates tab and click on it to see the certificates window popup

Image5.png

  • And check in “Trusted root certification Authorities” list and you should find “DigiCert Global Root CA".

Image2 (2).png

  • Similarly check in “Intermediate Certification Authorities” list and you should find “DigiCert TLS RSA SHA256 2020 CA1 ".

Image3.png

Internet Explorer:

  • Open Internet Explorer.
  • On the Tools menu, click Internet Options
  • Navigate to tab “content”
  • Click on Certificates button.

Image1 (2).png

  • And check in “Trusted root certification Authorities” list and you should find “DigiCert Global Root CA".

Image2 (2).png

  • Similarly check in “Intermediate Certification Authorities” list and you should find “DigiCert TLS RSA SHA256 2020 CA1 "

Image3.png

  • If the certificate is not present, please proceed with steps mentioned under: “How to import certificate into my browser?”

How to import the certificate into my browser?

  • Open Internet Explorer.
  • On the Tools menu, click Internet Options.
  • On the Security tab, click "Custom Level" to open the Security Settings dialog box.
  • Under "Reset custom settings", select Medium in the "Reset to" box. Click OK to close the Security Settings dialog box.    

  Note: Certificates cannot be installed when the security setting is set to High.

  • Navigate to tab “Content” 
  • Click on Certificates button.
  • Go to tab “Trusted root certification Authorities” list and Import attached Digi Certificates using "Import" button at bottom.
  • Ensure that “DigiCert Root and Intermediate" is added in the list.

I notice a discrepancy in the validity start date and end date mentioned in this knowledge article table and my downloaded certificate. What does this indicate?

Sometimes, due to time zone difference, you may see a different date in the downloaded certificate. There is no impact on the certificate update activity due to this. You will be renewing the certificate well in advance, before the certificate expiry date.

Keywords

KBA , akamai , domain certificate , LOD-CRM-SEC , Security Topics , Problem

Product

SAP Cloud for Customer core applications all versions

Attachments

crm_ondemand_com_186284435_Russia.zip
crm_ondemand_com_186283576_Restoftheworld.zip