Keystore Views and Certificates Monitoring

SAP AS Java manages certificates and cryptographic keys through a Key Storage service, organizing them into multiple virtual containers known as Keystore Views. These views serve as the foundation for core security operations, including encryption, digital identification, and signature verification, across AS Java functions. Underlying each view is a distributed database where the actual key and certificate entries are persisted.

IT-Conductor simplifies the oversight of these assets by providing automated discovery and threshold-based monitoring of Keystore Views and their certificates from a single platform.

Permissions

To enable IT-Conductor to monitor keys and certificates, ensure the required roles and permissions are configured before proceeding.

1. Sign in to IT-Conductor and on the main menu navigate to Support > Downloads > SAP Security Downloads and download the SAP J2EE Monitoring Role. This role has high-level monitoring permissions and includes access to the keystore/keystore-views action, which governs access to Keystore View discovery.

2. Assign the SAP J2EE Monitoring Role to an SAP user designated for monitoring.

Note: Learn more about the SAP J2EE Monitoring Role in our documentation.

Figure 2: ITCONDUCTOR_MONITORING Assigned Actions View in Detail

1. Grant access to individual certificates by assigning specific actions as needed. For example: Monitoring the certificates in SecureLoginServer keystore view:

Figure 3: Sample SecureLoginServer View in Detail

1. Assign the required permissions to the designated monitoring user by creating a new role ITCONDUCTOR_CERTIFICATES with the following actions:

   1. keystore-view.SecureLoginServer / view-actions.all.all

   2. keystore-view.SecureLoginServer / entry-actions.all.all

Figure 4: Sample ITCONDUCTOR_CERTIFICATES View in Detail (a)

1. Repeat step #4 for all views that require their certificates to be monitored:

   1. keystore-view.<View Name> / view-actions.all.all

   2. keystore-view.<View Name> / entry-actions.all.all

Figure 5: Sample ITCONDUCTOR_CERTIFICATES View in Detail (b)

1. Assign the newly created role ITCONDUCTOR_CERTIFICATES to the designated monitoring user.

Validation

Confirm the configuration is correct by verifying the following:

• Verify that the monitoring role has been updated with the required actions for the relevant Keystore Views and certificate entries.

• Confirm that the monitoring user can access the relevant monitoring sections in NWA.

• Confirm that the monitoring user can open the respective Keystore Certificate entries without any access-denied or runtime errors.

• Ensure that permissions are granted explicitly for each Keystore View, rather than through wildcard permissions.

After performing all these steps, IT-Conductor will discover and start monitoring individual certificates under the Key Store

Figure 6: Sample Individual Certificates

Note: This is the only way SAP allows granting access to individual certificates. Although IT-Conductor only requires READ access, there are no such actions configured out-of-the-box by SAP. If your organization has qualified SAP J2EE developers, they can create custom actions to grant only READ access in SAP Java Studio and install them into the system. These actions can be assigned to the ITCONDUCTOR_CERTIFICATES role instead of view-actions.all.all/ entry-actions.all.all

Monitoring keys and certificates in IT-Conductor

IT-Conductor automatically discovers all Keystore Views and any certificates within views where the monitoring user has access. From there, you can configure thresholds to track Keystore View status as well as Certificate Expiration and Days to Expiration.

Key Monitoring Metrics

• Keystore View Status — The overall health state of a Keystore View, calculated by SAP as the "worst of" status across all entries it contains.

• Certificate Expiration — The date on which a certificate becomes invalid and can no longer be trusted.

• Days to Expiration — The number of days remaining before a certificate reaches its expiration date.

Figure 1: Sample Keystore Views and Certificates

Related Information

• SAP PO Application Monitoring