SAP Root CA certificate update

This communication is intended for the teams responsible for the SAPRouter in your organization. If you are not the appropriate contact, please forward this message to your IT department or SAP administrator.
To ensure continued and secure connectivity between your SAPRouter and Esker services, we would like to inform you of an upcoming change related to SAP's certificate infrastructure.
 

Home › SAP Root CA certificate update

 

Background

SAP has renewed its Root Certificate Authority (CA) and introduced a new root certificate called SAP Cloud Root CA.

Esker has already updated its SAPRouter infrastructure to support this new certificate. To ensure continued and secure connectivity between your SAPRouter and Esker services, customers operating their own SAPRouter are required to update their trust store to include the new SAP root certificate by October 16th 2026 along with the existing Root CA maintained on your SAPRouter, if this has not already been completed.
 

Who Is Affected?

This communication applies to customers who:

  • Have a SAPRouter connection established with Esker
  • Have not yet installed the new SAP Cloud Root CA certificate in their SAPRouter trust store (local.pse).

 

Why Is This Important?

The connection between your SAP system and Esker will break if you do not install the new SAPRouter Root CA certificate by October 16th 2026.

Potential symptoms include:

  • SAPRouter connection failures
  • SNC encryption errors
  • RFC errors
  • Certificate trust validation errors

 

Required Action

We recommend importing the new SAP Root CA certificate into your SAPRouter trust store by October 16th 2026 at the latest.

You can download the new certificate from this link.

Alternatively, you can download the certificate directly from SAP via the official SAPRouter documentation available on the SAP Support Portal: SAP_RootCA2026.pem.

After importing the certificate into your SAPRouter trust store (local.pse), please restart the SAPRouter service.

For complete installation steps, please refer to the Esker documentation page.

 

Verification Information

After the import, you may verify that the following certificate is present:

  • Field / Value
  • Subject: CN=SAP Cloud Root CA, O=SAP SE, L=Walldorf, C=DE
  • Serial Number: 18770FBE65066BBF4CEA9338D9B18562
  • SHA-1 Fingerprint: 6D:80:92:77:4A:F2:D5:ED:AE:3A:5C:99:D6:56:93:1C:21:97:A9:50

 

What Will Not Change

This update only adds a trusted certification authority to your SAPRouter trust store.

The following remain unchanged:

  • Your existing SAPRouter certificate
  • Your private keys
  • Your network configuration
  • Your SNC configuration
  • Your current SAPRouter routing settings

Esker’s support portal is available if you need any assistance or have any questions: https://support.esker.com/

Best regards,
Esker Support

Top