Step by Step Guide On SAP Support Backbone Update and Enabling Note Assistant For Digitally Signed SAP Notes - SAP Blogs PDF

3/17/2020 Step by Step guide on SAP Support Backbone Update and Enabling Note Assistant for Digitally Signed
itally Signed SAP Notes | SAP Blogs
Community
Ask a Question Write a Blog Post Login
Technical Articles
Praveena Subramani
November 14, 2019 30 minute read
Step by Step guide on SAP Support Backbone Update and

Enabling Note Assistant for Digitally Signed SAP Notes
Follow RSS feed Like
27 Likes 27,705 Views 17 Comments
As you are already aware by now, SAP has updated the support backbone infrastructure, to ensure that its
critical infrastructure is up to date and secure, and will switch o the legacy infrastructure on January 1st, 2020.
Due to the increasing demand placed on the support backbone, SAP has updated the infrastructure to continue
to provide us with the support we require. As part of this process, the way in which systems connect to SAP has
been redesigned to include the following changes:
The HTTPS protocol is now used instead of RFC.

A technical communication user handles the data transfer instead of generic users.
There is no generic inbound interface.
Applications send data asynchronously unless the data is sent manually.
You would have been seeing warning messages in SAP systems, SNOTE transaction, EWA reports and SAP
Service marketplace notes download sections, to update your systems to support SAP Backbone update.
This blog will explain in detail actions which are required to be con gured in all SAP ABAP systems before
January 2020 to ensure smooth connectivity SAP Support Backbone.
It is advisable to go through the whole blog before starting the implementation and open the SAP notes and
guides referred in this blog as SAP updates the notes on regular basis.
https://blogs.sap.com/2019/11/14/step-by-step-guide-on-sap-support-backbone-update-and-enabling-note-assistant-for-digitally-signed-sap-notes/ 1/75
3/17/2020 Step by Step guide on SAP Support Backbone Update and Enabling Note Assistant for Digitally Signed SAP Notes | SAP Blogs
What is SAP’s Support Backbone?

Con gurations and Implementations of Snotes for TCI Enablement based on system releases
Setup of connections ( Either RFC or HTTP or Download Service) to SAP Support Backbone based on
system versions
Enable Note Assistant for digitally signed SAP Notes
De ned the right procedure to download SAP Notes based on system releases
De ned the le type for downloading SAP Note
SDCCN, ANST, RFC Con guration changes
Reference links and SAP notes
What is SAP’s Support Backbone?

SAP’s Support Backbone is the central infrastructure located at SAP to provide technical support to our
customers.
The SAP Support Backbone has been updated.
The legacy infrastructure remains in place to allow a safe transition for customers.
You need to switch the communication of SAP Solution Manager and Focused Run to the new infrastructure
before January 2020 to ensure continuous connectivity.
To get a list of all systems in your landscape which are not yet ready and need to be switched to the new support
backbone connectivity refer link
It will take you to the Early Watch Alert Work space and pre-selects the lter for “Backbone Connectivity”. As a
result, you get a list of all systems (at least those who send EarlyWatch Alert reports to SAP) which are not
ready yet and need to be connected to the updated support backbone infrastructure.
You then can drill down further to understand which action needs to be taken:
Refer below landing page for details on support backbone connectivity update. Landing Page for Support
Backbone Connectivity Update
Note: This list will show all the systems which are not ready to connect to the updated support backbone. If you
would like to see systems which are ready (green alerts), remove the ltering category and search for the text
string “HTTPS -> SAP”. If this produces too many results, you can also use the search term “backbone”.
Impact of SAP Support Backbone Update and Required actions

As a result of the update, the following systems actions are mandatory:
SAP Solution Manager systems

When you switch to the new communication channels to enable the exchange of data with the updated SAP
Support Backbone the following is required:
Scenario 1: You are on SAP Solution Manager 7.2
Upgrade to SAP Solution Manager SP07 or higher (*Upgrade to SP08 or higher is recommended)
Scenario 2: You are on SAP Solution Manager 7.1
Upgrade to the latest SAP Solution Manager 7.2 support package
Please note: For SAP partners (PartnerEdge Sell, VAR, CCC, PCOE), SP08 or higher is required.
Focused Run for SAP Solution Manager systems

The new communication channels in Focused Run 2.0 enable the exchange of data with the updated SAP
Support Backbone. All Focused Run customers need to upgrade to Focused Run 2.0. Focused Run 1.0
systems will not be able to communicate with the SAP Support Backbone after January 1st, 2020.
Information on upgrading Focused Run can be found in the Focused Run Expert Portal.
Remark: Focused Run 1.0 will enter its Customer-Speci c Maintenance phase on November 23rd 2019.
ABAP systems with direct connectivity to the support backbone

All customers with ABAP based SAP systems need to react to the SAP Support Backbone update to ensure
connectivity of their SAP systems to the SAP Support Backbone.
1. Enabling Note Assistant for Transport Based Correction Instructions
2. Enabling Note Assistant for Digitally Signed SAP Notes
3. Setting up connections to SAP Support Backbone
4. De ning Procedure and File Types to Consume Digitally Signed SAP Notes
5. SDCCN direct connectivity/ Indirect connectivity update, ANST update, SAP RFC destinations update
Step by Step process to prepare managed system to support SAP Support

Backbone Update

Preparation and Prerequisite:
1. Request a Technical Communication User
Connections using generic users will not work anymore after January 1st, 2020. For this purpose, customers
need to ensure that all connections use a technical communication user in all systems which have connectivity
to SAP (this includes all systems directly sending EWA data to SAP and all systems where SAP Note Assistant is
being used on).
We must request a technical communication user for the systems ( Refer SAP Note 2174416) . (You cannot
convert a regular S-user into a technical communication user.) The technical communication user is required,
for example, to download digitally signed SAP Notes from Note Assistant (transaction SNOTE). Technical
communication users cannot be used to log on in dialog mode, and their passwords do not expire.
After you have requested a technical communication user, it is generally available within 24 hours.
Hint: If preparing an SAP Solution Manager system for the support backbone update, this step is automatically
covered there and can be skipped in all managed systems.
Technical communication users can be requested via this app.
2. If the system to be prepared for SAP’s Support Backbone Update is not directly connected to the
backbone, no further action is required.
For all other systems, including SAP Solution Manager systems, Focused Run systems, and ABAP systems, with
direct connectivity to the support backbone, you have to be on the following plug-in levels:
ST-PI 2008_1_7xx SP20 and higher, or ST-PI 740 SP10 and higher
ST-A/PI 01T* SP01 and higher
3. Strongly recommended that you upgrade your SAP Solution Manager systems to Release 7.2, Support
Package Stack 8 or higher.
1. Enabling Note Assistant for Transport Based Correction Instructions

It is strongly recommended that you enable Note Assistant to work with transport-based correction
instructions (TCIs). However, to ensure that your systems can continue to communicate with the support
backbone, it is su cient that they can work with digitally signed SAP Notes.
The TCI is a new way to deliver ABAP correction instructions to customers in a exible manner. A TCI bundles a
stack of correction instructions in one transport request that can be installed using the SNOTE transaction.
The TCI reduces the installation time because it requires no pre or post installation steps.
SAP Note : 2187425 – Information about SAP Note Transport based Correction Instructions (TCI)
The TCI enablement in SNOTE are available in the following Support Packages of their respective
SAP_BASIS releases. If a system is in any of the following SPs or above SPs, then, implementing
the bootstrap is not needed:
Note: All higher releases (752 and above) has the enablement from SP00 itself.
For the releases listed in the table above, if you are on lower SPs, perform the following steps:
2.1 Update to Support Package Manager (SPAM) version 70 or higher.
2.2 Implement the list of notes given below, based on the SAP_BASIS release of your system. Doing this enables
SNOTE for TCI.
TCI SNOTE Table
After applying all the prerequisite SAP notes as per your system release apply the bootstrap SAP note to enable
TCI in your system.
Procedure for Implementing the Bootstrap SAP Note
Download the Bootstrap TCI:
In our scenario below we are in Basis level 740
a) Search and open the relevant bootstrap SAP Note xxxxxxx from SAP One Support Launchpad. For more
information on relevant bootstrap SAP Notes, refer to the above TCI notes table.
b) Choose Correction Instructions and select SAP_BASIS Software Component.
c) On the Correction Instruction view, select the relevant software component version (on the left side) and
choose Download (on the right side). Save the SAR le into your directory.
d) Log on into client 000 of the ABAP system you want to install the TCI.
e) Upload the bootstrap TCI SAP Note to the system: Call transaction SPAM, then choose Support Package >
Load Packages > From Front End and navigate to the directory, into which you downloaded the SAR le (for
example, K70003CPSAPBASIS.SAR).
De ne queue:
a) In transaction SPAM, display the new support packages.
b) From the OCS Package Directory: New Packages view, select the respective bootstrap TCI SAP Note.
c) To de ne the TCI queue, click the Calculate Queue button.
Click No
Note: If you receive the following message “Not allowed Support Package is already applied,” the import of TCI
is not required as the required changes are already available in the system.
d) Import the TCI queue: Click the Import queue button to import the TCI queue and complete the steps.
Continue to import and complete
e) Con rming the queue: Once the queue is imported, you are prompted with the next action – to go to the SAP
Note Assistant (transaction SNOTE) and download (Even if the Note is available download it again) and
implement the bootstrap note; that the status of the SAP Note is completely implemented. Doing this will
automatically con rm the SPAM queue.
Note: If your system is not connected to the Online Service System (OSS) con rming the queue is not possible.
In this case, you rst download the SAP Note from the SAP Support Portal and upload SAP Note xxxxxxx (for
example, SAP Note 2446868 for 700 release) using the Note Assistant tool and then con rm the queue.
Verify the SAP Note Status: Verify if the status of the SAP Note xxxxxxx (for example, SAP Note 2446868 for
700 release) is set to Completely Implemented.
Preparing Note Assistant (Transaction SNOTE) is also called as bootstrapping.
Once the SNOTE is bootstrapped, any SAP Note containing TCI can be implemented in the same way as
implementing any other SAP Note.
Note: If you are on SPAM version 70 and above: the bootstrap note is transportable, you need not apply the
bootstrap note in each system. You can apply the bootstrap note 1995550 in Dev system and you can move the
TR to Quality and Production.
Please follow the below sequence :
1. Create 1st TR and capture all pre-requsite notes & release the TR.
2. Create 2nd TR for locking bootstrap note & release the TR.
3. Create 3rd TR for implementing digitally signed note TCI (*which will be explained in next section below) and
nally release the 3rd TR.
Move these TRs in sequence to Quality and Production.
2. Enabling Note Assistant for Digitally Signed SAP notes

SAP recognizes a security threat during upload of SAP Note into customer landscape. The SAP Note can get
modi ed maliciously and the customer can upload unknowingly the maliciously modi ed SAP Note into their
landscape.
Therefore, SAP delivers all SAP Notes having ABAP corrections with digital signature to protect SAP Notes with
increased authenticity and improved security.
SAP strongly recommends uploading or download only digitally signed SAP Notes. The digital signature
veri cation feature is enabled for both uploading or downloading of SAP Notes.
The SNOTE is enabled to work with Digitally Signed SAP Notes from the following SPs of their respective
releases of SAP_BASIS software component.
Note: All higher releases (753 and above) has the enablement from SP00 itself.
For the releases listed in the table above, if you are on lower SPs, perform the following steps:
Prerequisites
1. You have to implement the SAP Note 2408073 and SAP Note 2546220 for uploading digitally signed SAP
Note and digital signature veri cation.
2. You have to implement the SAP Note 2508268 for downloading digitally signed SAP Note.
(OR)
1. Implement TCI NOTE “2576306 – Transport-Based Correction Instruction (TCI) for Download of
Digitally Signed SAP Notes” containing the SAP Notes 2408073, 2546220 and 2508268
While uploading the TCI package if there is a failure in signature veri cation please refer to the SAP
Note 2520826 for solution.
“SAP recommends Implementing SAP Note 2576306 instead of applying the above individual
SAP Notes.”
Follow below steps to implement the SAP Note with the corresponding TCI in your development system, use the
Note Assistant via transaction SNOTE.
Note: Warnings about objects without directory entry can be ignored, since TCIs can contain deletions.
Import the adjustment transport into your productive system – to implement the TCI in productive system.
Procedure for implementing an SAP Note containing TCI
Download the SAP Note (which is also a TCI note)
Download the TCI package:

a) Search and open the relevant SAP Note xxxxxxx in SAP ONE Support Launchpad
b) Choose Correction Instructions and select the relevant software component.
c) On the Correction Instruction view, select the relevant software component version (on the left side) and
choose Download (on the right side). Save the SAR le into your system.
d) Log on into client 000 of the ABAP system you want to install the TCI.
e) Upload the TCI SAR le in the Note Assistant, Choose Goto > Upload TCI
Note: Alternatively, you can upload the TCI SAR archive (for example, K700005CPSAPBASIS.SAR) through
Support Package Manager or SAINT from front end to your development system
To do so, call transaction SPAM or SAINT in client 000 and choose Support Package > Load Packages > From
Front End in transaction SPAM or Installation Package > Load Package > From Front End in transaction SAINT.
Note: If Upload TCI is not available in SNOTE transaction, then execute Report RSLANG20(Refer to SAP Notes
110910 and 48624). After this step, launch SNOTE and choose Goto > Upload TCI
Implement the SAP Note xxxxxxx as any other SAP Note in Note Assistant
Copy the corrections to Transport request and proceed
Download TCI correction for rollback
Upload rollback TCI in SNOTE and extract it.
Continue to implement the TCI note 2576306
If you get error message: 2258238 snote data not available, apply Snote 2258238 and continue to implement
2576306
Now all the required TCI notes are applied in the ABAP development system and copied in transport request,
which can be moved to production system.
Required Authorizations
If the veri cation of digital signature for an SAP Note fails, the Note Assistant tool logs the security event in
the application server using log object (CWBDS). To view the application logs, you should have authorization to
the S_APPL_LOG authorization object.
3. Setting up connections to SAP Support Backbone
The tables below provide an overview of the RFC connections that were previously used to connect to the
support backbone, along with the new HTTPS connections.
Note: For SAP Solution Manager, some destinations are created as part of task list
SAP_SUPPORT_HUB_CONFIG.
Once the prerequisite step of implementing 2576306 – Transport-Based Correction Instruction (TCI) for
Download of Digitally Signed SAP Notes is completed, follow below connection setup based on your system
version
1> RFC procedure for SAP_BASIS release 700 to 731 only

SAP ABAP systems with lower SAP Releases (= lower than SAP Kernel 7.42 Patch Level 400) who want to
download SAP notes or uses software components of ST-PI and ST-A/PI will still use RFC connection
SAPOSS or SAPSNOTE, but changes with that RFC connection`s SAPOSS or SAPSNOTE are mandatory!
This is the default procedure for all releases of SAP_BASIS until end of 2019.
From January 1 st 2020 the following will be enforce:
> This procedure will be the default option for SAP_BASIS releases 700 to 731 only.
> As system kernel version is below 742, we can use SAPOSS connection but we need to make
below changes.
> Generic user (OSS_RFC) will not be allowed in RFC destinations SAPOSS/SAPSNOTE.
> Only customer S user (recommended is Technical Communication User) will be allowed.
> SAPRouter string to the SAP Service and Support target system of the SAP infrastructure can be:
target host: /H/X1/S/S1/H/X2/S/3299/H/oss001.wdf.sap.corp with
X1 = IP address of saprouter on SAP customer side

X2 = IP address of sapservX
S1 = TCP port of SAPRouter on customer side
Possible settings for sapservX could be:
sapserv1 (194.117.106.129) Internet VPN connection

sapserv2 (194.39.131.34) Internet SNC connction
sapserv3 (147.204.2.5) SAP customers from Germany will typically use that settings
sapserv4 (204.79.199.2)SAP customers from US region will typically use that settings
sapserv5 (194.39.138.2) SAP customers from Japan will typically use that settings
sapserv7 (194.39.134.35) SAP customers from region APJ (Asia Paci c) inclusive New
Zealand and Australia will typically use that settings
sapserv9 (169.145.197.110) SAP customers from region APJ (Asia Paci c) inclusive New
Zealand and Australia will typically use that settings

sapserv10 (203.13.159.37) SAP customers from China will typically use that settings.
> There is no change in logon group, you can use 1_PUBLIC, 2_JAPANESE, EWA
> It is mandatory to use “oss001.wdf.sap.corp” and Load Balancing and a Technical

Communiation User in your RFC connection to SAP Backbone.
RFC destinations SAPOSS/SAPSNOTE will not work in ABAP systems on SAP_BASIS release 740 and above.
Instead HTTPS communication should be used.
2> HTTPS procedure for SAP_BASIS release 740 and above

For system higher than 740, mandatory protocol is HTTPS so we need to con gure RFC accordingly and
make relevant changes so SAP Notes gets download using HTTPS protocol instead of RFC protocol i.e.
SAPOSS
Destinations to SAP Support Portal and SAP Note Download needs to be de ned (SM59). Use S user
(recommended Technical Communication User) in the H and G type destinations
HTTPS encryption and communication path needs to be con gured
By following recommended destination names, con guration can be reused in other scenarios
Either manual or automatic con guration of HTTP connection setup can be followed. For manual step follow
“Digital Signature.pdf” attached to SAP Note 2576306
In our scenario we will see automatic setup.“SNOTE 2738426 for Automated Con guration of new Support
Backbone Communication”HTTPS prerequisites can be con gured in ABAP Task Manager (STC01) by
executing automated Task List SAP_BASIS_CONFIG_OSS_COMM.This task list contains common con guration
steps for the ABAP task manager, and automatically creates the required connections to the support
backbone.Technical Communication User and SAP Router string needs to be prepared before execution
Check SPAM version – minimum level 70, Implemented TCI note 2738426
Execute task list ‘New OSS Communication’:Run transaction STC01 to open Task Manager for Technical
Con guration
Select task list ‘SAP_BASIS_CONFIG_OSS_COMM’ – New OSS Communication
Task 1: Check CommonCryptoLib.
Task 2: We need to set parameter ssl/client_ciphersuites and parameter value for enabling highest TLS protocol
version with BEST-OPTION.
Check for the parameter, if it already exists with the required value no change is required if not we need to set
parameter ssl/client_ciphersuites value.
Before Con guration of parameter: value of ssl/client_ciphersuites parameter is not set
Added pro le parameter value as ssl/client_ciphersuites = 150:PFS:HIGH::EC_P256:EC_HIGH,
Restart the system after adding/changing parameter.
For more information, read SAP Note 510007 – Setting up SSL on Application Server ABAP
Task 3: Check certi cate for SSL Client
Checked in transaction STRUST, no certi cates exist.
Obtain certi cates from certi cate provider websites or use below link.
VeriSign Class 3 Public Primary Certi cation Authority – G5

DigiCert Global Root CA
DigiCert Global Root G2
Baltimore CyberTrust Root
Add the required certi cates and save it.
Note: Import client certi cate in SSL Client (Standard) or SSL Client (Anonymous), but relative option needs to
selected while running task list otherwise you will get error while running task list. I have imported all the above
client in SSL client (standard)
Task 4: Create HTTP connection
Maintain the elds Technical Communication User, Password and Router String (optional, if required), press
‘Return’, ‘Save’ and ‘Back’
Task 5: Change the user in RFC connection SAPOSS with technical user
Task 6: Select Restart of ICM if required, optional
Execute the task list by pressing button ‘Start/Resume Task List run in Dialog (F8)’
Click on the detailed log icon of each task to see the results of the task execution
Checked in transaction SM59, new connection destinations are created by the execution of above tasks list.
Following RFC’s created by Digital Signed process are working ne (test is good):
SAP-SUPPORT_PORTAL (Status HTTP response is 200)

SAP-SUPPORT_PARCELBOX (Status HTTP response is 200)
SAP-SUPPORT_NOTE_DOWNLOAD (Status HTTP response is 404)
3> Download Service application for SAP_Basis Release 700 onwards

Available for SAP_BASIS release 700 onwards
Any ABAP system having download service can be used as download system.
The SAP NetWeaver download service allows you to download les directly into your SAP NetWeaver
Application Server ABAP system from any SAP destination addressed through a URL.
The most important use case for the SAP NetWeaver download service is downloading from SAP le shares
connected to the SAP Support Portal and the download of SAP Notes with all their dependencies and relevant
SAP Notes transport-based correction instructions (TCIs).
The downloading of les from SAP le shares is only possible after a successful login to the respective SAP
Support Portal system with an S-user authorized for the le download.
With below scenario we will explain what to con gure to use download service. We have taken download system
as our Solution Manager 7.2 system in our scenario.
Implement SAP note 2554853 SAP Netweaver Download service for SAP Notes
The following information describes how to con gure the SAP NetWeaver download service to your needs.
Authorizations and Roles:
To carry out the following con guration tasks and to use the SAP NetWeaver download service, you require
speci c authorizations and roles.
Con guring the SAP NetWeaver download service involves the following steps:

Step 1: You set up the connection to the SAP Support Portal:
1.You maintain the S-user con guration using the transaction SDS_CONFIGURATION.
2. You con gure the client certi cates.
The following root certi cates must be registered for the SSL client SSL Client (Standard) in the SAP
NetWeaver system:
For access to https://smpdl.sap-ag.de or https://service.sap.com : VeriSign Class 3 Public Primary

Certi cation Authority – G5
For access to https://smpdla.sap.com : Baltimore CyberTrust Root
For access to https://*.softwaredownloads.sap.com or https://*.notesdownloads.sap.com: VeriSign Class 3
Public Primary Certi cation Authority – G5 and GeoTrust Global CA
For access to https://apps.support.sap.com : Symantex Class 3 Secure Server CA -G4
Procedure
1. To import certi cates, call transaction STRUST and, under SSL client SSL Client (Standard), choose Import
certi cate.
2. On the File tab page, browse to the downloaded certi cate les and import the certi cates by
choosing Continue Add to Certi cate List.
3. Save your changes.
The Certi cate List is now updated with the new certi cates.
If the SAP NetWeaver download service fails during the download from these locations, see SAP Note 2456654
.
If errors occur, restart the ICM Monitor using transaction SMICM. This restarts ICM services and reloads all
certi cates in your system.
3. You adapt the proxy settings.
Procedure
1.Adapting settings for a global proxy server
Call transaction SM59 and choose Extras HTTP Proxy Con guration.
On the Gobal Settings tab page, make sure that a proxy server exists and specify destinations that should
not be accessed using the proxy server.
On the HTTPS Protocol tab page, enter the connection information for the proxy server and choose OK.
No Proxy settings are active in our environment, if you have proxy active please make the corrections and save
2. Adapting settings for a local proxy server
Call transaction SDS_CONFIGURATION in change mode.
On the Proxy Settings tab page, enter the connection information for the proxy server and choose OK
If you have proxy settings available enter them and save.
4. You con gure the HTTPS service.
Procedure
1. Check if the HTTPS service is con gured.
Call transaction SMICM (ICM Monitor) and choose Goto Services.

Check if an entry for the HTTPS protocol exists and is set to active.
2. If no active entry exists, choose one of the following options:
Create a non-permanent entry that is valid until the next restart.
To create a new entry, choose Service Create, enter the required information for an HTTPS
protocol and choose Create Service.
To activate an existing but inactive HTTPS entry, select the entry and choose Service Activate.
Create a permanent entry.
Call transaction RZ10.
Choose the default or instance pro le entry and create a new parameter entry
icm/server_port_<number> by choosing Extended maintenace Change Parameter Create.
Example: icm/server_port_2 PROT=HTTPS, PORT=44300, PROCTIMEOUT=300, TIMEOUT=300
3. To enable the download of SAP Notes from https://apps.support.sap.com, call transaction RZ10 and create
the pro le parameter ssl/client_ciphersuites with the value 918:PFS:HIGH::EC_P256:EC_HIGH.
Step 2: You set up the download directory.
The logical le DOWNLOAD_SERVICE_DIR is de ned and delivered by default. It points to the

/usr/sap/trans/EPS/in directory in UNIX nomenclature. This path is speci ed in the de nition of the logical
path DOWNLOAD_SERVICE_PATH.
If the target directory ts your system, you can use the default logical le DOWNLOAD_SERVICE_DIR. You can
also adjust the directory to which the logical path DOWNLOAD_SERVICE_PATH is pointing to your target
directory, or you can create your own logical le paths, assignments of physical paths to logical paths and
logical le names.
Procedure
Adjusting the physical path assignment of the default logical path
1.Call transaction FILE and select the DOWNLOAD_SERVICE_PATH entry in the Create a logical le path table.
2. Go to Assignment of Physical Paths to Logical Path and adapt the physical path according to your target
directory or operating system, respectively.
3. Save your changes.
(OR)
De ning a new logical le
1. Call transaction FILE, choose New Entries, and specify a logical le path.
2. Under Assignment of Physical Paths to Logical Path, assign a physical path.
3. Go to Logical File Name De nition, Cross-Client, double-click your logical le, assign your new logical le path
to it, and save your changes
Step 3.You maintain execution parameters using the transaction SDS_CONFIGURATION.
1. Creating a user-speci c execution parameter
On the Execution Parameters tab page, choose Create Entry.
In the upcoming dialog box, for all elds the hard-coded system defaults are set. Enter here the
respective values for your con guration. If you want to create a system default execution parameter,
enter all values except the user name.
2. Changing an existing execution parameter
On the Execution Parameters tab page, select the entry that you want to change and choose Change
Entry.
Enter your changes.
You can change all parameters but the user name.
Con rm your changes by choosing Continue and then Save.
3. Deleting an execution parameter
On the Execution Parameters tab page, select the entry that you want to delete and choose Delete Entry.
The entry is removed from the Execution Parameters table.
Step 4. You set up the SL protocol service.
Prerequisites
You only need to perform this step if the following situations apply:
The release version of your SAP NetWeaver Application Server ABAP is 7.4 or higher.
The SL protocol is used.
Procedure
Call transaction SICF.
Set the Hirarchy Type to SERVICE and choose Execute.
Expand the nodes under default_host and navigate to the following service trees:
SL protocol: <defaulthost>/sap/bc/rest/SLProtocol
REST protocol: <defaulthost>/sap/bc/rest
Ensure that the services are active.
Once the connection to SAP support backbone is decided and con gured, we can use them to consume
digitally Signed SAP Notes by customizing in report RCWB_SNOTE_DWNLD _PROC_ CONFIG .
4. De ning Procedure and File Types to Consume Digitally Signed SAP Notes
Following are the two modes through which you can consume the digitally signed SAP Notes:
How to Upload Digitally Signed SAP Notes Using SNOTE Transaction

How to Download Digitally Signed SAP Notes Using SNOTE Transaction
1.How to Upload Digitally Signed SAP Notes Using SNOTE Transaction
Digitally signed SAP Notes are available from SAP ONE Support Launchpad. You can upload the digitally signed
SAP Notes into the SNOTE transaction as follows:
Procedure
1. Download the digitally signed SAP Note from SAP ONE Support Launchpad
2. Run the SNOTE transaction

3. From the menu bar, choose Goto -> Upload SAP Note
2.How to Download Digitally Signed SAP Notes Using SNOTE Transaction
Based on your SAP NetWeaver version, you have the following ways to download SAP Notes into your system.
Download Procedures for NetWeaver 700 to 731:
1. Download service
2. RFC (Enabled by default)
Download Procedures for NetWeaver 740 and later:
1. Download service
2. HTTP
3. RFC (Enabled by default until end of 2019.
To directly download the digitally signed SAP Notes using SNOTE transaction, proceed as follows:
Depending upon the settings de ned in the Customization, the digitally signed SAP Notes are downloaded.
1. De ning Procedure for Downloading SAP Note (RCWB_SNOTE_DWNLD _PROC_ CONFIG)
2. De ning File Type for Downloading SAP Note (RCWB_UNSIGNED_NOTE _CONFIG) Note
De ning Procedure for Downloading SAP Note (RCWB_SNOTE_DWNLD _PROC_

CONFIG)
With the introduction of digitally signed SAP Notes, various procedures or modes are o ered for downloading
the SAP Notes. You use this report to de ne a procedure based on your requirement for downloading the SAP
Note.
The report RCWB_SNOTE_DWNLD_PROC_CONFIG is used for customizing the di erent procedures.
If you are on the SPS level where the feature is delivered or implemented the TCI 2576306, this activity can be
performed through IMG customization (IMG > SAP NetWeaver Implementation Guide > Application server >
Basis Services > SNOTE )
This is a one time set up. If required, you can change the settings in this report at any given point in time.
RFC procedure for download of digitally signed SAP Note
If you choose this option, the system uses RFC destination SAPOSS or SAPSNOTE, whichever is applicable, to
download the digitally signed SAP Note.
By default, the system uses the RFC option when no other option is selected.
->Starting 1st January 2020, downloading SAP Note using RFC procedure will no longer be supported
for NetWeaver 740 and higher. You need to choose a download procedure between Download
Service Application or HTTP Protocol.
HTTPS procedure for download of digitally signed SAP Note
If you choose below option, the system uses the HTTPS protocol to download the digitally signed SAP Note.
When you run this report RCWB_SNOTE_DWNLD_PROC_CONFIG using the transaction SE38, following are the
various procedures o ered in the report to download the SAP Note. Select HTTPS and save con guration.
Validation:
Try to download one SNOTE and check the logs.
Logs will now contain Digitally Signed SAP note is downloaded using HTTPS as below.
Note: When using this option we faced situation where no proper messages are displayed like below, to solve it
follow manual action in 2508268 snote
After maintaining above message numbers with text we were able to read the SNOTE log texts properly.
Download of digitally signed SAP Note using Download Service application
If you choose this option, the system uses the Download Service application to download the digitally signed
SAP Note.
The download service can be present in the same system that you are using to download the digitally signed
SAP Note or in another system. For example, the SAP Solution Manager can be used as the download service
system. Ensure that you have established the RFC connection, of type 3, to the download service system.
Advantage: Associated Transport based Correction Instruction (TCI) packages and prerequisite SAP
Notes are downloaded automatically
For example, assume you have an SAP Note and that SAP Note has around 20 prerequisite SAP Notes. When
you try to download the SAP Note, the 20 prerequisite SAP Notes also get downloaded automatically. Whereas
in the other two options (RFC and HTTP Protocol), the prerequisite SAP Notes get downloaded during the
implementation of the present SAP Note
In report RCWB_SNOTE_DWNLD_PROC_CONFIG, choose download service
On the Download Service System the RFC destination has been set to NONE and click save.
Validation:
Tried to download one SNOTE and check the logs.
Logs will now contain Digitally Signed SAP note is downloaded using Download Service as below.
Note: Refer below snotes if you face any issues while downloading SNOTE with download service.
2803658 – After con guring the Netweaver Download Service for SAP Notes, attempting to download a note
gives Error I:SCWNL810 NONE.
2608378 – Download fails when downloading a high number of Notes
2618713 – Timeout during download of SAP Notes via SAP Download Service
De ning File Type for Downloading SAP Note (RCWB_UNSIGNED_NOTE _CONFIG)

Report RCWB_UNSIGNED_NOTE_CONFIG was used to set “Do not download unsigned SAP Note”
In future when you try to upload any SNOTE which is not digitally signed choosing this option will not allow that
SNOTE to be implemented in our system.
5. SDCCN direct connectivity/ Indirect connectivity update, ANST update,

SAP RFC update

SDCCN Con guration Update:
After you have upgraded to the latest version of ST-A/PI, you must specify new HTTP connections in Service
Data Control Center.
Below is automatic option we get to migrate tasks in SDCCN.
Click on migrate tasks, and validate RFC destinations in task speci c settings in SDCCN are migrated.
In below scenario we explain how to manually make con guration changes in SDCCN,
Goto Settings-> task speci c
Add destination SAP-SUPPORT_PORTAL and Remove destination SDCC_OSS
Delete all tasks that have the target SAP (O02).
Create the tasks again. The new tasks will use new destination SAP-SUPPORT_PORTAL or SAP-
SUPPORT_PARCELBOX depending on the task type.
ANST Con guration Update:
In ANST transaction, settings change RFC Destination from SAPOSS to SAP-SUPPORT-PORTAL if the SAPOSS
connection throws error while downloading SAP notes using ANST transaction.
Update of RFC connection to SAP Support Backbone:
In a SAP ABAP system the following RFC connections to SAP Service and Support backbone infrastructure can
exist:
RFC connections:
SAPOSS
SAPNET_RFC
SAPNET_RTCC
SDCC_OSS
CUPOSS
OSSNOTE
SAP-OSS
SAP-OSS-LIST
SAP-OSS-LIST-O01
SM_SP_<customer number>
If you connect to SAP Support Backbone infrastructure with an RFC connection not listed here, identify and
check the RFC connection. To identify such an RFC connection to OSS, consider using transaction SE16 in your
ABAP system and table rfcdes.
RFC connection SAPOSS or SAPSNOTE to SAP Service and Support backbone infrastructure needs to be
updated before January 2020; other RFC connections similar to RFC connection SAPOSS or SAPSNOTE are
normally not necessary anymore
It is mandatory to replace the existing generic user`s (like OSS_RFC) in a RFC connection like SAPOSS or
SAPSNOTE with a Technical Communication User
Please check the settings of RFC connection SAPOSS (or SAPSNOTE) and change it, if necessary.
You still can use logon group 1_PUBLIC or EWA or 2_JAPANESE
The servers behind the 3 logon groups are con gured identically. Japanese customers of SAP SE can still use
logon group 2_JAPANESE. Other customers can use either logon group 1_PUBLIC or EWA
You still can use target system “OSS”
You still can use message server “oss001.wdf.sap.corp”. Please do NOT change that setting with
“oss001.wdf.sap.corp” !
Please use Load Balancing and set the ag to “yes”. It is mandatory to use ag “yes”.
Reference Links and SAP Notes:

->FAQ – Digitally Signed SAP Notes – 2537133
-> Cheat Sheet for enabling SNOTE for Digitally Signed SAP Notes and for TCI
2737826 – SAP Support Backbone Update / upcoming changes in SAP Service and Support Backbone
interfaces (latest) in January 2020.
2740667 – RFC connection SAPOSS to SAP Service & Support backbone will change (latest) in January 2020
2836302 – Automated guided steps for enabling Note Assistant for TCI and Digitally Signed SAP Notes
2392726 – How to unlock a Support Hub User (Technical Communication User)
2508268 – Download of Digitally Signed SAP Notes in SNOTE
2732094 – ANST – Implementing SOAP Based ANST Note Search
2690656 – New communication channel to SAP Backbone for transaction SDCCN
2174416 – Creation and activation of users for the Support Hub Communication
2554853 – SAP NetWeaver download service for SAP Notes
2783798 – SNOTE log messages displayed improperly after enabling Digitally Signed SAP Notes
2603877 – Exception handling corrected in download of digitally signed SAP Note for callers other than SNOTE
https://help.sap.com/viewer/9d6aa238582042678952ab3b4aa5cc71/7.4.19/en-
US/48b41a66fc096 4e10000000a42189b.html
Alert Moderator
Assigned tags
SAP Solution Manager | SAP NetWeaver | Note Assistant for Digitally Signed SAP notes | sap support backbone update |
Related Blog Posts
SAP SolMan 7.2 Insight… SAP Support Backbone Update

By Yuliya Khomich , Apr 08, 2019
Critical updates to ensure connectivity to SAP

By Robert Heer III , Jul 12, 2019
Enabling SNOTE for downloading digitally signed sap notes using download service procedure
By Sumit Jaiswal , Jan 08, 2020
Related Questions
"SCWN: 821" is displayed after executing RCWB_TCI_DIGITSIGN_AUTOMATION

By Hsu Tang-Jia , Dec 16, 2019
Enabling Note Assistant for Digitally Signed SAP Notes
By Venu Reddy , Nov 19, 2019
VAR setup for subsidiary

By Former Member , Oct 03, 2014
17 Comments
You must be Logged on to comment or reply to a post.
Jānis B
November 15, 2019 at 5:57 am
«You would have been seeing warning messages in […] SAP Service marketplace notes download sections, to
update your systems to support SAP Backbone update.»
Yeah, and closed – by now, like, many hundreds of times, I believe. They are so <expletive> annoying, and I have
neither the roles and authorisations, nor the mandate to do what they implore me to do… Do you know how to
turn them o , please?
Thanks,
Jānis
Like (0)
Praveena Subramani | Post author
Hi Janis
If you are mentioning about the warning message in SAP Service marketplace notes download section, it will be
available till January 2020, as it is an alert message to all customers to make necessary changes prior. We
cannot turn o them.
The warning message when you open SNOTE tcode in SAP systems should disappear after you apply the
required corrections to enable digitally signed SAP notes, and make necessary changes as mentioned in the
blog as per your system release.
Regards
Praveena
Like (1)
Pankaj Pabreja
Hi Praveena,
Nice blog, however I would suggest you to correct the below sections in your blog
2.1 Update to Support Package Manager (SPAM) version 69 or higher.
Once the SNOTE is bootstrapped, any SAP Note containing TCI can be implemented in the same way as
implementing any other SAP Note. The bootstrapping of SNOTE is not transportable. Whereas the
implementation of SAP Note containing TCI, in SNOTE, is locked in Transport Request and is transportable.
If you are on SPAM version 70 and above: the bootstrap note is transportable, you need not apply the bootstrap
note in each system.
I have done that and transported it from Dev to QA and prod, you can check the detailed steps here
I would also recommend to create separate TRs for below:
1. 1st TR for pre-requsite notes, release the TR.

2. 2nd TR for locking bootstrap note, release the TR.
3. 3rd TR for implementing digitally signed note TCI and nally release the 3rd TR
Move these TRs in sequence to QA and prod.
Regards,
Pankaj
Like (0)
Praveena Subramani | Post author
Hello Pankaj,
Thank you for the suggestion, and yes I have updated them.
Regards
Praveena
Like (0)
Ravichandra Samineni
Hi Praveena,
why this step is required in stc01 that is last before step (Old OSS Comm: Con guration of SAPOSS Connection
(OSS1): and you said need to maintain technical user in old SAPOSS rfc…..is it mandatory to maintain the
technical user iD? and also can we delete the SAPOSS rfc? we are at sap netweaver 7.5 sps12, please respond.
Regards
Ravi
Like (0)
Carlos Prieto del Toro
December 3, 2019 at 2:31 pm
Hi! thanks a lot for this detailed procedure, i really appreciate
I have a question here, if i am running SAP_BASIS 740 SP19, i know that i need to implement notes 2536585,
2606986, 2615270 & 2569813 (if valid) do i need to implement also the bootstrap for note 1995550? i mean i
am confused because i read that the bootstrap is not needed for 740 SP16 and above so this means that i only
need to implement the notes i put above?
thanks!
Like (0)
Aamrin Firdoush
Hi Ravi,
If you basis release is above 740,you don’t need to maintain suser in sapsoss,and more over your note download
will work with https connection not through RFC after implementing the digitally signed note.
Like (0)
Indervir Singh
Below note has been released for Bootstrapping system for TCI and Digitally signed ennoblement. With this
note, customers can perform TCI and Digitally signed ennoblement in guided way
2836302 – Automated guided steps for enabling Note Assistant for TCI and Digitally Signed SAP Note
Like (0)
Mark Hallett
Hi Praveena
In our Solution Manager system, when we run the Task List SAP_SUPPORT_HUB_CONFIG from transaction
STC01, in step 7 “Check connectivity and credentials to SAP Support Portal” we
are getting connected ok, but get an error “SAP service point ping error
: 401 unauthorized”
The “Checklist for Support Backbone Update” document states to check if the Technical User is locked which
we have and its not locked – it has a tick against “Active for Data Transfer”
We have reset the password in the SAP Portal https://launchpad.support.sap.com/#techuser and updated the
same password in SM59 RFC SAP-SUPPORT_PORTAL
But despite all the above we still get the error in STC01 task list
SAP_SUPPORT_HUB_CONFIG – step 7 “Check connectivity and credentials to SAP Support Portal”
Please can you advise
Kind regards
Mark
Like (0)
Mark Hallett
I resolved my issue but just requesting a di erent technical user. Not sure why the existing one wouldn’t work,
but the new one worked ne.
Like (0)
Symon Braunbaer
I have con gured the ABAP Download Service on the Solution Manager (7.2 SPS09).
I have con gured one satellite system – NetWeaver 7.31 to use the download service.
I created an RFC type 3 connection to the Solman for this.
When I try to download an SAP note, it simply says – Download Service could not
download the SAP note.
Well, what a descriptive error message !!!!!! What am I missing ? Am I missing something
in the con guration ?
How to diagnose that ?!? How can I check the Download service ?
I digged out the whole internet – not a word about that !!!
Like (0)
Symon Braunbaer
OK, nobody replies, but I will continue to write…

I have a NetWeaver 7.4 SP07 system.
I am now trying to implement this bunch of notes. Note 2576306 has 8 (!!!!!!) PAGES of manual prerequisites
!!!!!!!!!!!!!!!
Other notes had 3, so it makes together 11 (!!!!!!!) pages of manual operation !!!!!!!!!!!!!!
Then I had some activation errors and it took a short while to x them.
Now I am SHOCKED to determine, that there are about 12 (!!!!!!!!!!!) pages of manual POST-
PROCESSING steps… I already spent 5 hours doing this and I expect it to take AT LEAST
4 hours more !!!!!
And we have 3 more NetWeaver 7.4 based landscapes !!!!!!!!! WHO can ever manage to do
that !!!!!!!!! THIS IS OUTRAGEOUS and the MOTHER OF ALL BAD IDEAS of SAP to force us
to do that and this in such a short time till 1-Jan-2020 !!!!!!!!!!
PLEASE advise whether there is an easier way to do this, because I am at the end of my
stregth now…
Like (0)
BD Team
December 19, 2019 at 3:40 am
HI Symon,
I found more easy way to complete this activity, use PDF attached to KBA 2836302
Step 1- Implement note 2836302 in Development system. It will bring report

RCWB_TCI_DIGITSIGN_AUTOMATION
Step 2- Execute the report in client 000, to check the steps need to be performed based on NW version.
After executing the above report will give you insights of the activity need to be performed in the system.
Regards,
BD team
Like (2)
Symon Braunbaer
December 23, 2019 at 12:54 am
MANY THANKS !!!!!!!
Your reply was a GAME CHANGER !!!!!! WHY is not EVERY guide beginning with – Implement SAP note
2836302 ?!? I had it a WAAAAY easier from then on, with only minimal manual corrections !!!
Wondering how is that even possible… Do you know if the report RCWB_TCI_DIGITSIGN_AUTOMATION is doing
most of the manual actions automatically ?
However I had one bigger obstacle – in the rst system where I tried to directly implement the notes,
SAP note says that it Cannot be implemented. I found some solutions, including implementing note
1995550, however it could still not be implemented and I had to create all the new RFC destinations
by hand. However, now everything is working just ne !!!
THANK YOU SOOOOOO MUCH !!!!!!!!!!!
Like (1)
Taimur Khan
January 2, 2020 at 4:52 pm
Dear Praveena Subramani,
Thank you so much for such a detail documentation. Really appreciate it.
Taimur
Like (1)
Luka Prijic
January 8, 2020 at 12:24 pm
Hello,
Great article. However, I am having issues and I am stuck on step
2> HTTPS procedure for SAP_BASIS release 740 and above on Task 4: Create HTTP
connection
I am on Basis Release 7.40 SP Level 0013 and Kernel 742 Sup. PKG 400
On step where I need to de ne SAP Router string, it always fails, and on my SAPRouter I get:
checkRoute: native routing denied (0)
It seems that SAPRouter would not allow that destination port for nal location is HTTPS default port 443.

How can I solve this issue?
KR,
Luka
Like (0)
Arwel Owen
January 30, 2020 at 12:31 pm
Excellent article, Praveena. Many thanks for sharing with the community.
Arwel.
Like (0)
Find us on
Privacy Terms of Use
Legal Disclosure Copyright
Trademark Cookie Preferences
Newsletter Support

Step by Step Guide On SAP Support Backbone Update and Enabling Note Assistant For Digitally Signed SAP Notes - SAP Blogs PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Step by Step Guide On SAP Support Backbone Update and Enabling Note Assistant For Digitally Signed SAP Notes - SAP Blogs PDF

Uploaded by

Copyright:

Available Formats

3/17/2020 Step by Step guide on SAP Support Backbone Update and Enabling Note Assistant for Digitally Signed

itally Signed SAP Notes | SAP Blogs

Ask a Question Write a Blog Post Login

Step by Step guide on SAP Support Backbone Update and

27 Likes 27,705 Views 17 Comments

The HTTPS protocol is now used instead of RFC.

What is SAP’s Support Backbone?

What is SAP’s Support Backbone?

The SAP Support Backbone has been updated.

Impact of SAP Support Backbone Update and Required actions

SAP Solution Manager systems

Scenario 1: You are on SAP Solution Manager 7.2

Scenario 2: You are on SAP Solution Manager 7.1

Upgrade to the latest SAP Solution Manager 7.2 support package

Focused Run for SAP Solution Manager systems

ABAP systems with direct connectivity to the support backbone

connectivity of their SAP systems to the SAP Support Backbone.

1. Enabling Note Assistant for Transport Based Correction Instructions

2. Enabling Note Assistant for Digitally Signed SAP Notes

3. Setting up connections to SAP Support Backbone

Step by Step process to prepare managed system to support SAP Support

Preparation and Prerequisite:

1. Request a Technical Communication User

Technical communication users can be requested via this app.

ST-A/PI 01T* SP01 and higher

1. Enabling Note Assistant for Transport Based Correction Instructions

b) Choose Correction Instructions and select SAP_BASIS Software Component.

c) To de ne the TCI queue, click the Calculate Queue button.

Continue to import and complete

Preparing Note Assistant (Transaction SNOTE) is also called as bootstrapping.

Please follow the below sequence :

Move these TRs in sequence to Quality and Production.

2. Enabling Note Assistant for Digitally Signed SAP notes

Procedure for implementing an SAP Note containing TCI

Download the SAP Note (which is also a TCI note)

Download the TCI package:

b) Choose Correction Instructions and select the relevant software component.

Copy the corrections to Transport request and proceed

Download TCI correction for rollback

Upload rollback TCI in SNOTE and extract it.

Continue to implement the TCI note 2576306

3. Setting up connections to SAP Support Backbone

1> RFC procedure for SAP_BASIS release 700 to 731 only

From January 1 st 2020 the following will be enforce:

target host: /H/X1/S/S1/H/X2/S/3299/H/oss001.wdf.sap.corp with

X1 = IP address of saprouter on SAP customer side

Possible settings for sapservX could be:

sapserv1 (194.117.106.129) Internet VPN connection

Zealand and Australia will typically use that settings

> It is mandatory to use “oss001.wdf.sap.corp” and Load Balancing and a Technical

2> HTTPS procedure for SAP_BASIS release 740 and above

HTTPS encryption and communication path needs to be con gured

Select task list ‘SAP_BASIS_CONFIG_OSS_COMM’ – New OSS Communication

Task 1: Check CommonCryptoLib.

Before Con guration of parameter: value of ssl/client_ciphersuites parameter is not set

Added pro le parameter value as ssl/client_ciphersuites = 150:PFS:HIGH::EC_P256:EC_HIGH,

Restart the system after adding/changing parameter.

Task 3: Check certi cate for SSL Client

Checked in transaction STRUST, no certi cates exist.

VeriSign Class 3 Public Primary Certi cation Authority – G5

Add the required certi cates and save it.

Task 4: Create HTTP connection

Task 6: Select Restart of ICM if required, optional