3810056 - Different security certificates observed across multiple tenants of SAP Datasphere

SAP Datasphere tenants have different security certificates

• SAP Datasphere

1. Sign in to a SAP Datasphere tenant.
2. Open the browser, and near URL there is "Connection is secure" -> "Certificate is valid" 
3. Observe that presented certificates may differ across tenants and the certificate common name may not match expectations.

• External systems experienced a trust mismatch after a change in the certificate issuer.
• The expectation that all certificates are issued by a single certificate authority (CA) and relying on the certificate Common Name (CN) instead of the Subject Alternative Name (SAN) caused confusion about validity.

Datasphere uses certificates which are part of the BTP Trust Store. DigiCert is not the only Certificate Authority used by SAP.
Therefore you should not expect all of SAP certificates to be issued by one CA.
For more information, see the SAP Note 3472211 - BTP Trust Store: Collection of TLS Server Root CA certificates used by SAP BTP.

Instead of checking the Common Name of the certificate, check the Subject Alternative Name (SAN) field to see which hosts the certificate is valid for as this is how the browser validates the certificate.

• 3472211 - BTP Trust Store: Collection of TLS Server Root CA certificates used by SAP BTP

certificate, tls, ssl, subject alternative name, san, common name, cn, certificate authority, ca, trust store, btp trust store, issuer change, trust mismatch, external connection, validation failed, odata, remote table , KBA , DS-SEC-AUTZ , Authorizations (Locks, etc.) , Problem