As of January 2009, SAP introduced maintenance certificates (as an addition to SAP licenses) that are typically valid for only three months. This created an additional manual effort to keep all systems updated and valid. Without the certificate, the SAP software logistics tools Support Package Manager (SPAM) and Add-On Installation Tool (SAINT), which implement Support Packages, display a warning and restrict access to this functionality. This led to a lot of manual maintenance work for administrators. However, SAP Solution Manager can automatically fetch the required certificates periodically and distribute them to your managed systems. Read on and discover what’s required to get this up and running in SAP Solution Manager.

Maintenance Certificates

All SAP products based on SAP NetWeaver 7.0 and higher (SAP NetWeaver Business Warehouse [SAP NetWeaver BW] 7.0, SAP ERP Central Component [SAP ECC] 6.0, SAP Solution Manager 7.0, SAP Customer Relationship Management [SAP CRM] 7.0, and SAP NetWeaver Process Integration [SAP NetWeaver PI] 7.1) require maintenance certificates. This maintenance check was delivered via SPAM/SAINT update 7.0 (31). As of version 7.0 (33/34), an error functionality can appear and restrict access to installing Support Packages any further until the maintenance certificate is installed in the system. Figure 1 shows an example of the error message you would see if you tried to install a Support Package in any system based on SAP NetWeaver 7.0. 

Figure 1

Example of a missing maintenance certificate error message in SPAM

Relevance to SAP Solution Manager

Once maintenance certificates are installed, they are typically valid for only three months, after which they have to be renewed per installation. Therefore, SAP offers an automatic deployment option using SAP Solution Manager as the central tool. With little configuration, you can use it to automatically request and distribute maintenance certificates for all managed systems, eliminating the manual effort of repeating this task every three months.

Before you begin the steps I describe, I assume that you have already performed the basic installation and setup of your SAP Solution Manager system but have not configured other functionalities, such as SAP EarlyWatch Alerts or system monitoring. (If you have, then you can still follow the steps because I also describe the steps you need to take if these functionalities are configured.) There are prerequisites and minimum requirements that you need to follow to complete the configuration, including critical points from SAP Note 1280664. Here is an important list SAP Notes that you should implement taken directly from SAP Note 1280664. In SAP Solution Manager, these are:

• SAP Note 1251060 (relevant for ST 400 Support Package 16 to Support Package 19)
• SAP Note 1266139 (relevant for ST 400 Support Package 16 to Support Package 18)

In the managed system, these are:

• SAP Note 1312413 (relevant for ST-PI 2005_1_700 Support Package 06, 2008_1_700 Support Package 00, 2008_1_710 Support Package 00)
• SAP Note 1293657 (relevant for ST-PI 2008_1_xxx Support Package 00)
• SAP Note 1381710 (relevant for ST-PI 2008_1_xxx Support Package 01)

I’ll cover all the necessary steps to enable the automation of the distribution of maintenance certificates in SAP Solution Manager and your managed systems. The automated deployment option using SAP Solution Manager is recommended but not required. A manual method for requesting certificates via the SAP Service Marketplace is also available, which I will also cover. The most important prerequisite is that you maintain the system data correctly and that it is up to date. Current system data is required to generate valid maintenance certificates for your systems.

Automatic Distribution via SAP Solution Manager

The following process for setting up distribution is automated once you set it up. Figure 2 shows this process in detail:

• SAP Solution Manager passes the system numbers of the managed systems to SAP
• SAP checks each system for a valid maintenance contract
• If no contract is found, the process ends and the user is informed
• If there is a valid contract, SAP checks for a maintenance certificate and returns it to the user’s SAP Solution Manager system via a Remote Function Call (RFC)
• If there is no maintenance certificate, SAP generates one. During the next cycle (24 hours), SAP Solution Manager can fetch the certificate.
• The certificates are passed to SAP Solution Manager, where they are saved
• The maintenance package (which runs daily) fetches the certificates from SAP Solution Manager via an RFC
• If this is successful, it is saved locally in transaction SLICENSE, which stores SAP licences and certificates
• Upon the use of SPAM or SAINT, the system is checked for a valid maintenance certificate

Figure 2

Detailed process

Configuration in the Managed System

In the context of this article, a managed system (or satellite system) is referred to as any system that meets the requirements of SAP NetWeaver 7.0 or higher and is connected to SAP Solution Manager via an RFC. A system that meets these minimum requirements indicates the ABAP stack, kernel, and supporting components are at least version 7.0.

The managed systems also need to meet the following minimum component requirements. The software component Solution Tools Plug-In (ST-PI) should be on at least one of the levels below (06 or 04), depending on the level of your SAP Basis component (700 or 710):

• SAP Basis 700: ST-PI 2005_1_700 SP06
• SAP Basis 710: ST-PI 2005_1_710 SP04

Automatic maintenance certificate distribution is not valid for any component level under the levels specified above.

You also need to apply these SAP Notes to each managed system as required:

• SAP Note 1312413 (relevant for ST-PI 2005_1_700 Support Package 06, 2008_1_700 Support Package 00, 2008_1_710 Support Package 00)
• SAP Note 1293657 (relevant for ST-PI 2008_1_xxx Support Package 00)

• SAP Note 1381710 (relevant for ST-PI 2008_1_xxx Support Package 01)

Activate the Service Data Control Center

You also must activate the Service Data Control Center (SDCCN). SDCCN is the new transaction that replaces the older SDCC. It is a crucial transaction in the setup of periodic tasks that trigger the request and distribution of maintenance certificates directly in the managed system. Figure 3 is an overview of SDCCN when you enter it directly (after activation).

Figure 3

SDCCN main screen

If it is the first time you access the transaction, then it automatically asks you for activation (and to disable the old SDCC) and to create a new RFC to SAP called SDCC_OSS. You must complete this task.

You see a blank list with no scheduled tasks in the To do tab. The first step in setting up SDCCN is to configure the RFC settings for your tasks. From the top menu, choose Goto > Settings > Task-specific (Figure 4).

Figure 4

Task-specific settings in SDCCN

Under RFC Destinations > Settings, click the settings icon . Figure 5 is displayed. The destination SDCC_OSS is already listed as active and connected to SAP. You need to add another destination for the back RFC, which is an RFC connecting back to SAP Solution Manager. You may have already generated this. If not, refer to the section on prerequisites in SAP Solution Manager later in this article.

Figure 5

RFC destinations

Click the change mode icon  and then click the add icon . Enter a meaningful description. From the selection list that appears in the Destination field (when you press F4), select the back RFC for SAP Solution Manager. The name of this RFC is SM_<SID>CLNT<Client>_BACK in this case (Figure 6). Click the green checkmark icon and then click it again on the next screen that appears.

Figure 6

New RFC destination back to SAP Solution Manager

This concludes the RFC settings setup in SDCCN. Later in this article, I show you how to make SAP Solution Manager the master of all managed systems so that it can override all settings centrally.

Schedule the Maintenance Package

The next setting in SDCCN is to schedule a periodic maintenance package task to process license and maintenance certificate requests (as well as SAP EarlyWatch alert data). To do this, go to the main SDCCN overview screen in Figure 3. In the To do tab, select Task > Create (Figure 7).

Figure 7

New task in SDCCN

Click the Maintenance Package button and click the green check mark icon to bring up a screen similar to Figure 8. Specify the date and time (preferably early each morning, such as 4:00 am) when the task should run. Check that the back RFC is your RFC destination and then click the run periodically icon  to schedule the job daily. Finally, click the save icon in the SDCCN overview screen shown in Figure 3 to confirm your settings.

Figure 8

Maintenance package settings

Schedule the Task Processor

Now you need to ensure the Task Processor (which is used to process the scheduled packages in SDCCN) is running. From the menu in Figure 3, choose Goto > Settings > Task processor (Figure 9).

Figure 9

Task processor settings

Click the change mode icon and click the Activate button, which will be in place of the Deactivate button in Figure 9 (if not already activated). Then, schedule the job as hourly starting the following hour and click the green check mark icon to confirm.

Disable the Refresh Sessions Task in SDCCN

If you have set up SAP EarlyWatch Alerts or have already activated SDCCN, a refresh sessions task may exist in your To do list. You need to disable this task because the logic is executed implicitly in the maintenance package task. Delete the task by highlighting the task and clicking the delete icon  in Figure 3.

System Number in SLICENSE

Another very important requirement is the system number in transaction SLICENSE of each managed system (Figure 10). Enter transaction SLICENSE in your managed system to access the view. If the system number doesn’t exist or is not valid, then the process fails and the system landscape (transaction SMSY) in SAP Solution Manager does not synchronize the system number correctly. You should ensure that the system number is correct and the same as the data in the SAP Support Portal.

Figure 10

License administration

Prerequisites in SAP Solution Manager

SAP Solution Manager needs to be at least version 7.0 with Support Package 16 for this functionality to be valid. Once you have completed the required tasks in each managed system, you can also perform the same tasks in SAP Solution Manager if you have not yet done so:

• Activate SDCCN as per managed system
• Schedule the maintenance package task
• Schedule the task processor job
• Disable the refresh sessions task
• Ensure the system number is present for SAP Solution Manager

Additionally, other requirements need to be met as described in the following subsections.

Define the Managed Systems in SMSY

A crucial requirement is that all managed systems are correctly defined in transaction SMSY with assignments to logical components and system types. Describing this in detail is outside the scope of this article, but doing this and synchronizing the system number is a critical part of the process. Figure 11 is an example of a system defined with the required details.

Figure 11

Sample system SMC defined in SMSY with system number

Generate RFCs to All Managed Systems 

Once you define your system, generate the RFCs. This is a fundamental requirement for enabling SAP Solution Manager to communicate with managed systems. An RFC needs to be generated from SAP Solution Manager to the managed system and a back RFC in the opposite direction needs to exist in the managed system. Figure 12 is an overview of RFC destinations to and from a managed system that you can access via transaction SMSY by viewing the Clients tab for a particular system. You can generate RFCs using the wizard or manually in transaction SMSY in SAP Solution Manager. RFCs form the basis for a lot of other functionality in SAP Solution Manager, but their generation is outside the scope of this article.

Figure 12

RFC destinations to and from a managed system

The back RFC connects the system back to SAP Solution Manager, which in turn uses an RFC to connect and request a maintenance certificate for the system from the SAP Service Marketplace. Then, the trusted RFC to the managed system is used to distribute any collected maintenance certificates.

Generate RFCs to SAP Support 

You need to have the RFCs to SAP configured and working. The RFC destinations SAPOSS and SAP-OSS need to exist and have a working connection to SAP. These RFCs are generated during the basic setup of SAP Solution Manager using transactions SOLMAN_SETUP and AISUSER.

Activate Work Centers and Assign Roles to Users

You need to follow the IMG activity that activates the required Work Center services and assign the roles to users. (The following is for SAP Solution Manager enhancement package 1 SPS19.) Follow IMG menu path SAP Solution Manager > Basic Settings > HTTP Services > Activate Solution Manager Services. Follow the IMG documentation to execute the three programs that activate the required services. Then you can test the services by selecting them.

You should have access to the Change Management Work Center via the roles SAP_SMWORK_BASIC and SAP_SMWORK_CHANGE_MAN. This is required for administering systems using the automatic distribution of maintenance certificates. To do this, follow IMG menu path SAP Solution Manager > Scenario-Specific Settings > Change Request Management > Standard Configuration > General Activities > Set Up Work Center for Change Request Management.

Configuration in SAP Solution Manager

Some additional configuration is required in SAP Solution Manager to be able to ensure automatic request, collection, and distribution of maintenance certificates.

Apply Critical SAP Notes

As I stated earlier, these are the critical notes you must implement prior to configuration:

• SAP Note 1251060 (relevant for ST 400 Support Package 16 to Support Package 19)

• SAP Note 1266139 (relevant for ST 400 Support Package 16 to Support Package 18)

Schedule the Necessary Background Job

A particular background job needs to be scheduled in SAP Solution Manager. Use transaction SM_CONFIG_JOBS and ensure job REFRESH_ADMIN_DATA_FROM_SUPPORT is scheduled and running.

Make SAP Solution Manager the Master of All Managed Systems

You have seen how to activate and configure SDCCN in all managed systems. However, changing common settings individually per system is very tiresome. Therefore, you should make SAP Solution Manager the master of all your managed systems. This ensures that the SDCCN settings specified in SAP Solution Manager override the SDCCN settings in the managed system and verifies that the RFCs are working correctly. To begin, use transaction SMSY and follow menu path Environment > Solution Manager Operations > Administration SDCCN (Figure 13).

Figure 13

SDCCN administration in SMSY

Click the add icon and go through the step of selecting your system and client. Then highlight the system from the list and choose Master System > Assign as Master System. If your RFCs are working and you have sufficient authorization, you receive a confirmation and you’re done. You can also call SDCCN in the managed system directly from here. To confirm the connection, click the check status icon .

Now if you change any settings in the SDCCN of the managed system, you receive a warning that SAP Solution Manager is the master and that it will overwrite any settings (Figure 14).

Figure 14

SDCCN task setting override

Activate Distribution Using the Work Center

There is a dedicated Work Center page for license management in SAP Solution Manager. To access this and administer which systems are to be enabled for automatic distribution, open the Change Management Work Center using transaction SOLMAN_WORKCENTER. Click the License Management link in the left menu and Figure 15 is displayed.

Figure 15

License Management Work Center

From here, you can select the managed systems defined in the SAP Solution Manager system landscape. After selecting the system, you can activate or deactivate automatic distribution of maintenance certificates by clicking the Automatic Distribution button. You can decide for which systems you want to automate the distribution (provided you have followed the prior configuration) and which you want to set as manual.

Clicking a system with a green traffic light status in the right column in Figure 15 displays the stored licenses and certificates in the lower part of the work center. The traffic lights indicate the status of the certificates. Note it takes a period of a few days for the tasks to run, the job to request, SAP to process and send, and SAP Solution Manager to save and distribute the certificates as per the process described earlier.

Viewing Certificates in the System

You can use transaction SLICENSE to view the maintenance certificates in a particular system. Click the New Licenses button and you see the installed licenses and certificates. Note that I clicked the Old Licenses button so old licenses are showing in Figure 16.

Figure 16

Transaction SLICENSE

Manual Approach to Installing Maintenance Certificates

There is a manual method you can use as an alternative to this process. I won’t delve into too much detail because I recommend automatic distribution; however, you can use the SAP Support Portal for manual renewal by referencing https://service.sap.com/support. You need to browse to the required system under the Data Administration portal. Select edit mode and open the License Key & Maintenance Certificate tab (Figure 17).

Figure 17

Data Administration portal on the SAP Service Marketplace

From here, you can request or renew your maintenance certificate and specify the recipient’s email address. Once you receive the email, you can download the certificate locally and upload it using transaction SLICENSE to the relevant system. You can follow a similar approach to download the license script locally and save it to the system.

Troubleshooting

Here is a list of the common causes of errors and items to double-check before requesting additional help. Ensure that:

• You have a valid maintenance contract with SAP
• Your systems meet the minimum component levels
• You have implemented the critical notes specified for the managed systems and SAP Solution Manager
• The system number and hardware key exist for each system and they are the same in the SAP Support Portal
• Your managed systems are defined correctly in SAP Solution Manager
• Your RFCs to the managed systems are defined and working, and the system data is synchronized in transaction SMSY
• The SAP-OSS, SAPOSS, and SDCC_OSS RFCs are working in SAP Solution Manager
• The maintenance packages and the task processor are scheduled in each system
• The refresh sessions task has been descheduled in each managed system
• SAP Solution Manager is the master of all managed systems
• The job REFRESH_ADMIN_DATA_FROM_SUPPORT has been scheduled in SAP Solution Manager
• The Work Centers (in general) are activated
• Automatic distribution is activated for each managed system in the Change Management Work Center

Still having problems? There may be other areas to troubleshoot and SAP Notes to implement. You should review the top five related SAP Notes below, with specific attention to SAP Note 1280664:

• SAP Note 1280664 — Distribution of maintenance certificates: Troubleshooting
• SAP Note 1240265 — SPAM/SAINT: No valid maintenance certificate found
• SAP Note 1293657 — Error in distribution of Maintenance Certificates via SDCCN
• SAP Note 1229904 — Maintenance certificate distribution for service provider
• SAP Note 1134886 — Activating log SDCCN for retrieval of maintenance certificate

The key component for SAP Note searching or for raising a support message to SAP concerning the automatic deployment of maintenance certificates is SV-SMG-LIC. You can also find a general overview of maintenance certificates in the SAP Service Marketplace at https://service.sap.com/maintenancecertificate.

Rohan Parikh

Rohan Parikh is the SAP Solution Manager lead in the SAP Competency Center for the UK’s largest integrated energy company, Centrica Plc. He holds a BSc(Hons) in computer science from King’s College — University of London, and is SAP certified in SAP Solution Manager operations. He has experience across the entire SAP Solution Manager domain but focuses on the landscape and operations management area of SAP Solution Manager. He has practical experience in implementing, configuring, and detailing a tailored SAP Solution Manager roadmap to deliver project-specific, business-related, and operational value from using SAP Solution Manager to its potential. He is enthusiastic about promoting the use of SAP Solution Manager to all end users.

You may contact the author at rohan@logify.co.uk.

If you have comments about this article or publication, or would like to submit an article idea, please contact the editor.