As part of many SAP landscapes, Secure Network Communication (SNC) is used to establish secure communication between ABAP and Java systems. If your environment is running with SNC-based communication between ABAP and ME/MII Java systems using SNC certificates stored in Java security directory.

While SAP Focused Run (FRUN) provides extensive monitoring capabilities, we identified a monitoring gap: there is no standard FRUN template available to monitor validity of Java SNC certificates. This means an expired certificate could go unnoticed until communication failures begin occurring between connected systems.

To address this gap, we developed a custom monitoring solution in SAP Focused Run that automatically tracks Java SNC certificate validity, calculates remaining days until expiration, and generates alerts before certificate expires.

Business Challenge

Communication between ABAP and Java systems relies on SNC certificates for secure authentication and encryption.

Java SNC certificate was deployed in the following location:
/usr/sap//J**/sec/SAPSNCS.pse

Although certificate is critical for secure communication, there was no proactive monitoring mechanism available in Focused Run to track its validity.

This created following risks:

Unplanned certificate expiration
ABAP to Java communication failures
Potential business process disruption
Manual monitoring effort
Lack of centralized visibility

Objective was therefore to provide proactive monitoring and alerting through SAP Focused Run.

Solution Overview

Implemented solution performs following functions:

Reads SNC certificate from Java PSE file.
Extracts certificate expiry date.
Calculates number of days remaining before expiration.
Generates output in JSON format.
Sends value to Focused Run through a custom metric.
Raises alerts when configured thresholds are reached.

Architecture Overview

SAPSNCS.pse
│
▼
sapgenpse export_own_cert
│
▼
OpenSSL Certificate Parsing
│
▼
Remaining Days Calculation
│
▼
JSON Output Generation
│
▼
FRUN Custom Metric
│
▼
Alerting & Notification

SNC Certificate Location

SNC certificate used by the Java system is stored in:
/usr/sap//J*/sec/SAPSNCS.pse

This PSE file contains the certificate information required for SNC communication.

Extracting Certificate Expiry Date

SAP utility sapgenpse can export certificate directly from PSE file.

sapgenpse export_own_cert -p SAPSNCS.pse | openssl x509 -noout -enddate

Example output: notAfter=Sep 29 15:45:21 2027

This date is then used to calculate remaining certificate validity.

Custom Monitoring Script

Following shell script was developed to calculate remaining days before certificate expiry.

#!/bin/bash
SAPGENPSE=”sapgenpse”
PSE_FILE=”SAPSNCS.pse”
expiry_date=$(
$SAPGENPSE export_own_cert -p “$PSE_FILE” 2>/dev/null |
openssl x509 -noout -enddate |
cut -d= -f2
)

expiry_epoch=$(date -d “$expiry_date” +%s)
current_epoch=$(date +%s)

diff_days=$(( (expiry_epoch – current_epoch) / 86400 ))

echo “{“type”:”integer”,”name”:”NumDays”,”value”:$diff_days}” \

/tmp/NUMDAYS.json

Sample Output

generated JSON file contains the certificate validity in days.

JSON
{
“type”:”integer”,
“name”:”NumDays”,
“value”:30
}

This output can be consumed directly by SAP Focused Run custom monitoring metrics.

Creating a Custom Metric in FRUN

Step 1: Create a Custom Monitoring Script

Deploy the script on the managed host where SAPSNCS.pse exists.

Example location:

Shell

/usr/sap/SID/J**/sec/calc_sapsnc_validity.sh

Step 2: Configure Simple Diagnostics Agent Script Metric

Create a new metric.

Example:

Parameter	Value
Metric Name	SNC Certificate Validity
Collection Type	Script
Script	calc_sapsnc_validity.sh
JSON Attribute	NumDays
Metric Type	Numeric

Custom agent metric was configured in SAP Focused Run to collect generated JSON value.

Metric periodically collects remaining validity days and displays them centrally in FRUN monitoring dashboards.

This provides sufficient lead time for certificate renewal activities before the certificate reaches its expiration date.

Monitoring Benefits

This implementation delivers several operational benefits:

Closes a monitoring gap in SAP Focused Run Provides centralized certificate visibility

Closes a monitoring gap in SAP Focused Run
Provides centralized certificate visibility
Eliminates manual certificate validation checks
Enables proactive alerting
Reduces risk of ABAP-Java communication failures
Improves overall operational readiness
Prevents service disruptions caused by expired SNC certificates

Lessons Learned

During implementation, one challenge encountered was script compatibility after transferring files from Windows to Linux systems. Script initially contained Windows CRLF line endings, resulting in execution errors.

Converting script to UNIX format resolved the issue:
dos2unix calc_sapsnc_validity.sh

Conclusion

Java SNC communication is a critical component for secure integration between ABAP and Java systems. Since SAP Focused Run does not provide a standard monitoring template for Java SNC certificate validity, organizations may lack visibility into upcoming certificate expirations.

By implementing a lightweight custom monitoring solution using sapgenpse, OpenSSL, and SAP Focused Run custom metrics, we successfully introduced proactive monitoring and alerting for Java SNC certificates.

This approach is simple to implement, easy to maintain, and significantly reduces risk of communication outages caused by expired SNC certificates.

Have you implemented custom certificate monitoring in SAP Focused Run or SAP Solution Manager? Feel free to share your experience and monitoring approaches in the comments.

In SOAMANAGER you can test if a web service can be reached by pressing the test connection button. Unfortunately there is no standard SAP program that performs this test in the background. So how to monitor the availability of a web service?

Solution: custom Z program that can be run online or in background.

In this case we have chosen to put the alert into SM21 system log. But you can also replace this part of the code with sending an email.

Preparation

In SE92 (see this blog) create a new message for the system log.

Z program for monitoring web service

Now create a new Z program:

REPORT z_bc_ws_check.

CONSTANTS zmesid TYPE char3 VALUE 'ZZ1'. "system log message ID defined in SE92
DATA: zif_soap_ping TYPE REF TO cl_soap_ws_ping.
DATA: zlv_ok TYPE boolean.

PARAMETERS zservice TYPE seoclsname. "webservice name
PARAMETERS zlp TYPE prx_logical_port_name. "logical port name


START-OF-SELECTION.

  AUTHORITY-CHECK OBJECT 'S_SRT_CF_C' "check soap runtime auhtorizations.
      ID 'ACTVT' FIELD '03'.

  IF sy-subrc EQ 0.

* create object for soap ping test
    CREATE OBJECT zif_soap_ping TYPE cl_soap_ws_ping.

* initialize ok code
    zlv_ok = 'X'.

* try the ping test
    TRY.
        CALL METHOD zif_soap_ping->if_soap_ws_ping~ping_ws
          EXPORTING
            service = zservice
            lp_name = zlp.
      CATCH cx_soap_ping.
* any error, clear the ok flag
        zlv_ok = ' '. "not ok
    ENDTRY.

    IF zlv_ok EQ ' '. "not ok
* write to SM21 system log
      WRITE: / TEXT-004. "ping not ok
      CALL FUNCTION 'RSLG_WRITE_SYSLOG_ENTRY'
        EXPORTING
          sl_message_area  = zmesid(2)
          sl_message_subid = zmesid+2
          data_word1       = zservice ##NO_TEXT.

      IF sy-subrc EQ 0.
        WRITE: / TEXT-001. "succes to write to SM21
      ELSE.
        WRITE: / TEXT-002. "fail to write to SM21
      ENDIF.
    ELSE.
      WRITE: / TEXT-003. "ping ok
    ENDIF.
  ELSE.
    WRITE: / TEXT-005. "not authorized
  ENDIF.

Create the text elements accordingly.

You can change the authorization check and in stead of writing system log message in SM21 do some other alerting like sending a mail, or pick up the entry in SAP Focused Run monitoring.

Running the program

Run the program:

Enter the webservice name and logical port. Hit execute.

You can also run the program in background mode. For example every 15 minutes. Create multiple steps for multiple web services to test.

Explanation

The program simply creates the object of type CL_SOAP_WS_PING to perform the web service ping. The ping test is then performed. Based on the result the text ok or an entry to SM21 is written.

Tag: monitoring

Enable JAVA SNC Certificate monitoring in FRUN