If you turn on encryption in SAP between the client and the server using the Secure Network Connection, then is there a load placed on the server to do all the encryption work? How big a load? Is it equivalent to the difference between HTTP and HTTPS on a web server?
Please clarify what you want to do.
Do you just want to create secure RFC connections from the SAP GUI to the SAP system? Which 3rd party security product will you be using (e.g. Kerberos).
Will you be using Single Sign On? i.e. via an AD server. If so, where will the secure connection be - full end to end?
With encryption, the main load is during the initial handshaking between the client and the server. During this process, keys are calculated and exchanged.
See the SNC User's Guide for information.
I have not seen any references to the load on the system. I did ask SAP OSS years ago but did not get a satisfactory reply.
You cannot compare the load of SNC (using DIAG) to HTTPS because the protocols are very different - DIAG is a lot leaner.
I have investigated the use of F5 servers. They can be used for software and hardware accelleration of HTTPS, but not for the DIAG protocol.
Related
I am investigating the use of SSL to ensure security when performing remote software updates to embedded systems. This means that I would like to ensure that only specific client machines may communicate with the embedded server system.
I understand that server certificates authenticate the identity of the server and client certificates authenticate the identity of the client and this prevents man in the middle attacks.
What I would like to know is if client certificates can be used in such a way that only clients with specific certificates, compatible with the server, can communicate with the server.
My interpretation so far from reading up on this is that that certificates are used to ensure that either client or server are who they say they are. Not to restrict access to specific clients. Is this correct?
If someone could help clarify this, and provide some pointers, I'd be grateful.
Thanks
I have an IIS hosted WCF Service that uses SSL encryption. This service makes requests to a SQL Server 2014 database instance. When I make a call to the service the response message is encrypted. So, the connection between the client (browser) and the service is secure. I also want the connection between the service and the SQL Server 2014 database to be secure.
This is where my question comes in. I am not exactly sure how to do this. I read the following article Enable Encrypted Connections to the Database Engine and I was able to successfully add the certificate to the SQL server database engine and changed the Force Encryption flag to True. But now I am a bit confused as to whether I want to configure the server to accept encrypted connections or the client to request encrypted connections. Based on the scenario I presented above it seems I want the client to request encrypted connections from the SQL Server DB correct? I guess one reason I am confused is because this is ALL happening on my development machine. SQL Server is being hosted there as is the IIS Service.
If someone with experience could maybe clarify that for me I would greatly appreciate it.
If you haven't restarted the service, then do so to complete the configuration change. It sounds like you applied the change correctly and using a domain or public CA certificate will prevent a man in the middle attack. To verify that the connections are secure, you can use a DMV named sys.dm_exec_connection which should display true for the encrypt_option for all sessions, as below:
select session_id, net_transport, encrypt_option from sys.dm_exec_connections
I'm not certain that connections from the host to SQL Server will be encrypted by SSL\TLS since they would be using the shared memory protocol and Windows manages the security of shared memory.
We are setting up replication between RavenDB instances running in server mode. The instances are in different availability zones so we need a secure connection between the servers. According this this post SSL is not supported in server mode but
should be easy to add
Is there an extensibility point in the API where SSL support can be plugged in?
The API doesn't have any place for this currently, but I'm sure it would be a welcome contribution if you were so inclined to write this and submit a pull request. The underlying server is just a System.Net.HttpListener, which can be wired for ssl.
Your entry point would be at Raven.Database.Server.HttpServer.StartListening()
You would want the SSL certificate to be as easy to configure as the hostname or port. The cert itself should probably be pulled in from the Windows certificate store.
One of my friend is working on issue related to updating expired digital certificates.
He is working on Java application(Swings I guess), which has 4000 clients. All those need a digital certificate to connect to the application and this certificate expires every year.
At the end of year he needs to update the certificate credentials for all clients. Currently this is manual process, done by connecting to each of 4000 systems either locally or by remote connection.
He is got task to convert this process to be an automated process.
Normally the client-side certificate (used by authenticating the client on the server) needs to be passed to the client physically (on the carrier), otherwise, if the certificate is sent via electronic channels, there's a high risk of interception. But if secure connection is used, then the problem becomes less critical.
So the answer depends on how the client-side application is built. The easiest approach would be to add capabilities to refresh the certificate (before it expires) right from the application. The application would request fresh certificate from the server.
If no such capabilities are built-in and there's no way to add them, then the answer would depend on where the client-side application stores the certificate, used for authentication. If it's some file, then automating remote desktop connection using some automation tool would be the only choice.
I am developing a site that has a Flex app that uses php to communicate with a MYSQL database and I intend to get an SSL certificate to secure the communication. Subscribers to the service that I intend to provide will have an admin panel built with adobe air that will also need to communicate with the database. My question is how do I secure that communication? Do I need a different SSL cert for each subscriber? I hope not!
SSL will only protect the connection between the clients machine and the server from trivial snooping by 3rd parties.
It won't, for example, protect your database if it is open to the internet publically. You'll need to secure the connection for that by having a server interface to it, instead of having it open directly. This interface is typically called a 'webservice' or similar. I can't comment much more because I'm not at all familiar with flex.
In AIR, it should work the same for your Flex app in the browser. If you communicate over an HTTPS URL, the data is encrypted. There's nothing special you need to do.