Configuring Certificate Renewals

SSL certificate-issuing authorities have set the duration of an SSL certificate to 398 days. An expired SSL certificate means that visitors to the career site see a security warning and are blocked from accessing the site. For this reason, you never want to let the SSL certificate expire.

To view the expiration date for an existing SSL certificate, open the public career site and choose the padlock icon to the left of the URL. Follow the prompts.

Career Site Builder offers the following reminder methods about renewing SSL certificates:

• The ability to enable email reminders for admin users
• A pop-up dialog that appears when logging in to Career Site Builder

Email Reminders

Email reminders are triggered at 90 days, 60 days, 30 days, and 7 days before the certificate expires. Emails are sent to users who have Enable SSL Notification selected from Users→Roles→Admin Users.

To help administrators identify the specific Recruiting career site certificate that is set to expire, the email reminders include the following information: RCM Company ID, Career Site Builder Site ID, Site Name, Career Site URL.

Pop-up Banner Reminders

A pop-up banner is shown to all users with access to the Site Configuration menu in CSB when the certificate is going to expire in less than 90 days. For this reason, add users who are responsible for the SSL certificate to Recruiter SSO. See Units 5 and 10 for details about settings CSB permissions.

• If the user selects Acknowledge, the banner will not display next time they log in.
• If the user selects Ignore, they will be reminded again the next time they log in.

Customers can have multiple certificates installed and in use. When there is more than one certificate issued to the same domain (for example, test01.sap.corp), the last one installed is active.

Remember that Career Site Builder (CSB) only supports two domains to access the site, defined from Career Site Builder→Settings→Site Configuration→Site Information:

• Site URL
• Use Redirect

See additional information about SSL certificates in the Recruiting guide, including tips to complete the CSR fields. Navigate to the page, SSL Certificates Settings in Career Site Builder Tools.

There are different types of SSL certificates.

The leading practice is to use Option 1 to generate a CSR for a subdomain SSL certificate for your customer’s career site. Option 1 may not be used to generate a CSR for a wildcard certificate. Wildcard certificates are supported, but are not the leading practice as it involves the risk of compromising the required private key for SSL installation. When following the recommended process (Option 1), SAP has the private key, so there is no issue with compromising the private key in transit.

If the customer desires the use of an existing wildcard certificate, use Option 2 to upload it, along with the private key. Wildcards became popular for fluid websites that are not permanent. For a permanent, known domain, customers should have a proper registered SSL certificate instead of a wildcard certificate. For more information, see SAP Knowledge Base Article(KBA) 2809025 - SSL installation using wildcard certificates - Recruiting Marketing (2809025 - SSL installation using wildcard certificates - Recruiting Marketing).

A number of Knowledge Base articles have been written with important information about SSL certificates, including the following:

• 3109381 – Overview About SSL Certificates tab in CSB: Describes the renewal process, lists error messages, and more. (https://launchpad.support.sap.com/#/notes/3109381)
• 2565122 – FAQ on SSL Certificates for RMK Career Sites: Lists the accepted certificate formats, when a new certificate is required, and more. (https://launchpad.support.sap.com/#/notes/2565122)
• 2231401 – Updated SSL Certificate Renewal process - Recruiting Marketing: Provides explicit steps for implementation consultants, (https://launchpad.support.sap.com/#/notes/2231401)
• 2563741 – Unable to Access the Production RMK Career Site - Recruiting Marketing: Explains why a production CSB Career Site might not be accessible to users on the Internet or within the customer environment, usually because the DNS isn't mapped to an IP address on the Internet. (https://launchpad.support.sap.com/#/notes/2563741)

• SSL certificates now have a maximum duration of 398 days; if a certificate expires, visitors will see security warnings and may be blocked from accessing the career site, so renew before expiration.
• You can check the current certificate’s expiration date by opening the public career site, clicking the padlock icon next to the URL, and viewing the certificate details.
• Career Site Builder (CSB) provides renewal reminders via email (sent at 90/60/30/7 days to admin users with Enable SSL Notification) and an in-app banner for users with Site Configuration access when expiration is within 90 days (Acknowledge hides it; Ignore shows it again next login).
• SSL setup considerations: multiple certificates can exist for the same domain (the most recently installed is active); CSB supports only two access domains (Site URL and Use Redirect); best practice is generating a CSR for a subdomain cert (Option 1), while wildcard certs are supported but not recommended unless uploading an existing wildcard + private key (Option 2).