Managing the SSL Certificate for the Production Career Site

Implementation partners use the SSL Certificates page to obtain and install the original SSL certificate for the customer’s CSB career site. Customers or partners use the tool to renew SSL certificates.

The purpose of setting up SSL is to encrypt personal data being passed between the Career Site Builder site and the SAP SuccessFactors Recruiting applicant tracking system (ATS) when a candidate applies to a job. The SSL also serves as authentication, proving that the site belongs to that company.

SSL is only enabled for the production environment. Stage SSL is a low level of security settings applied to the entire environment. SAP may enable it, but most users see a certificate error during User Acceptance Testing (UAT) as a result. This is not a defect.

The implementation consultant, working with the customer, must begin the process as soon as the site is moved to production.

It takes a minimal amount of time to generate the CSR, submit the certificate, and install it. But, it may take one to two weeks to obtain the certificate, depending on the certificate authority. Renewals are typically handled faster.

Access to Career Site Builder requires the Manage Career Site Builder permission from Admin Center.

If Career Site Builder's role-based permissions are enabled, set the SSL Certificates permission from CSB by selecting Users→Roles for any users who should have access. Customers may want to create a role that can only access SSL certificates, not other parts of Career Site Builder. The role would allow other individuals in the organization, such as the IT security team, to manage SSL certificates.

The customer’s IT security team can use the following information to populate the fields on the SSL certificate signing request:

• Common Name (CN): The fully qualified domain name of the hostname using lowercase letters (a-z), uppercase letters (A-Z), digits (0-9), periods (.), and hyphens ( - ). 64-character limit. Don't use wildcard characters (such as an * asterisk), commas, port numbers, path names, or protocol as part of the name (such as http:// or https://). Subdomains must start with an uppercase or lowercase letter. Example: jobs.sap.com.
• Organization (O): The legal name of the organization. Don't abbreviate or use any of these symbols: ! @ # $ % ^ * ( ) ~ ? > < / \
• Organizational Unit (OU): The department or division name.
• Certificate Manager Email Address: The email address of the person in the organization who is responsible for managing SSL certificates. This individual may or may not be the same as the contact person.
• City/Locality (L): The city or locality of the organization. Don't abbreviate the City/Locality. For example, use Saint Louis and not St. Louis.
• State/Province (ST): For U.S. and Canadian organizations, enter the state or province. Don't abbreviate. U.S. organizations should specify the state they operate from, even if they're incorporated in another state.
• Country/Region (C): This field contains the 2-character ISO format country/region code. For example, use GB for Great Britain, and US for the United States. Refer to the following for a complete list: https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2
• Subject Alternative Name (SAN): The Common Name (CN), and any additional hostnames covered by the certificate, separated by commas. 64-character limit. Don't use wildcards, port numbers, path names, or protocol as part of the name (such as http:// or https://). Subdomains must start with an uppercase or lowercase letter.

Select the number in the Reference ID ID column to view CSR Details and the Certificate Audit History.