How to Renew SAProuter Certificate (Step-by-Step Guide 2026)

Learn how to renew SAProuter certificate with step-by-step commands, screenshots, and verification steps. Easy guide for beginners.

SAProuter certificate renewal is required to maintain secure communication between SAP systems and external networks. In this guide, you will learn how to renew the SAProuter certificate step by step using simple commands and real examples.

SAProuter Certificate Renewal Steps:

1. Backup existing local.pse and certreq
2. Generate CSR using sapgenpse
3. Submit CSR on SAP portal
4. Download certificate (srcert)
5. Import certificate using sapgenpse
6. Run seclogin command
7. Restart SAProuter

What is SAP Router Certificate?

SAProuter is a secure communication tool that acts as an intermediary between SAP systems and external networks. It controls access and ensures encrypted communication using certificates.

When Do You Need to Renew SAProuter Certificate?

• Certificate expiration warning
• SAProuter connection issues
• Security compliance requirements
  

Prerequisites

• SAProuter installed
• Access to OS level (Linux/Windows)
• SAP Cryptographic Library (SAPCRYPTOLIB)

Step 1: Check Current Certificate Validity

sapgenpse get_my_name -n validity

This command checks the validity of the current SAProuter certificate.

Before deleting or renaming any files, make sure to take a backup of the following: cred_v2, local.pse, srcert, and certreq.

Step 2: Copy the Distinguished Name (Parameter for sapgenpse) from SAP Portal

Login to the SAP Support Portal → Tools → Connectivity Tools → SAProuter.

Step 3: Create Certificate Request

If certreq and local.pse file exist then delete or rename the both file before running below command

sapgenpse get_pse -v -r certreq -p local.pse
This command generates a certificate request file (certreq) which will be uploaded to SAP Support Portal.

Enter and confirm the PSE PIN, paste the Distinguished Name copied from Step 2, and the system generates the certreq certificate request file.

Verify that the “certreq1” file has been created successfully.

Step 4: Submit Request to SAP

Upload the generated certificate request file to the SAP Support Portal and request a new SAProuter certificate.

Note: Before doing this, rename the existing srcert file.

Step 5: Import New Certificate

sapgenpse import_own_cert -c srcert -p local.pse

This command imports the new certificate into your SAProuter.

Step 6: Create the “cred_v2” file

Execute the following command using the PIN created earlier (Step 3):
sapgenpse seclogin -p local.pse

Step 7: Restart SAProuter Service

On Windows/Windows Server, go to Services, locate the SAProuter service, and restart it.

For Linux OS: 
saprouter -r

Restart the SAProuter service to apply the new certificate.

Step 8: Verify Certificate Renewal

sapgenpse get_my_name -v -n validity

Ensure the new certificate validity dates are updated.

sapgenpse get_my_name -v -n Issuer
sapgenpse get_my_name

Common Errors and Troubleshooting

• Invalid PSE PIN: Ensure correct PIN is used
• Certificate not imported: Verify file path
• SAProuter not starting: Check logs and permissions

Conclusion

Renewing the SAProuter certificate is essential for maintaining secure SAP communication. By following the above steps, you can easily generate, request, and install a new certificate without downtime.