sap-crypto-pselisted

# SAP cryptography — `sapgenpse` and PSE management **What this is.** `sapgenpse` is the command-line tool of **CommonCryptoLib** (`libsapcrypto.so` / `sapcrypto.dll`) for creating and maintaining **PSEs** — Personal Security Environments. A PSE is the container holding a keypair, the own certificate and the trusted certificate list. **SNC and SSL/TLS in SAP both stand on PSEs**, which is why this one tool sits underneath SAProuter security, SAP GUI SNC, RFC encryption, and AS ABAP/Java HTTPS. Marks: **[V]** verified against SAP documentation, **[G]** cited but not read in full. Command syntax below is **[G]** from the SAP Help Portal *Maintaining the Server's Certificate List Using SAPGENPSE* and related pages unless noted. > ## 🛑 Before anything else: two environment variables decide what you touch > > ```bash > echo $SECUDIR # where PSEs and credentials live > echo $SNC_LIB # which crypto library is loaded > ``` > > **`SECUDIR`** normally points at `/usr/sap/<SID>/<INSTANCE>/sec` (or `.../DVEBMGS00/sec`). If it is > unset or points somewhere else, `sapgenpse` will happily operate on **a different PSE than the one > your system is using**, and everything will look successful while nothing changes. Check it first, > every time. --- ## 1. The concept that explains most failures A PSE has **two** artefacts, and they are not the same thing: | Artefact | What it is | |---|---| | **`<name>.pse`** | The PSE itself — keypair, own cert, trusted list. Protected by a