## 10.3 Legacy Configuration of Secure Internal Communication
Although it is recommended that you use the system PKI (public key infrastructure) that is automatically created during system installation to secure internal communication channels, you can set up and configure your own PKI. This manually configured PKI is also used if system replication is configured for the system.
## TLS/SSL Configuration for Communication Between Hosts
Since a host can both initiate a connection with another host (client role) as well as be the target of a connection initiated by another host (server role), every host in the system requires a public and private key
pair, and a public-key certificate (server certificate) with which it can identify itself to other hosts. Each host also needs the certificate or certificates with which it can validate the identity of other hosts. Typically, this is the root certificate or the certificate of the certification authority (CA) that signed the other hosts' certificates.
##  Note
SAP HANA dynamic tiering does not support legacy configuration (using a manually configured PKI). If you are using SAP HANA dynamic tiering, use the system PKI configuration.
Use CommonCryptoLib as the cryptographic library. It is installed by default as part of SAP HANA server installation.
To manually configure secure communication between hosts:
1. Create a CA for the SAP HANA installation using external tools, for example, the OpenSSL command line tool.
We recommend that you use a dedicated CA to sign all certificates used. We recommend storing your CA certificate in $DIR\_INSTANCE/ca . This is typically the root certificate.
##  Recommendation
Create one private CA for each SAP HANA host. Do not use public CA for securing internal SAP HANA communication.
2. On every host, create the required server certificates.
2. Every host is verified with its fully qualified domain name (FQDN). The common name (CN) must be the
FQDN of the host you get by reverse DNS look-up. The other fields describe your organization.
3. Sign the certificates with the CA.
4. On every host, create a local keystore named sapsrv\_internal.pse in directory $SECUDIR and import the private key and certificate, and the CA certificate (or root certificate).
3. In the communication section of the file global.ini , create the property ssl with the value on .
## TLS/SSL Configuration for Cross-Site Communication in System Replication Scenarios
In a system with system replication enabled, communication between sites (metadata and data channels) can be secured using the same configuration described above. For the data communication, you also need to enable SSL with the property [system\_replication\_communication] enable\_ssl in the global.ini configuration file. For more information, see Secure Internal Communication Between Sites in System Replication Scenarios .
## Keystore Configuration
The [communication] sslInternalKeyStore parameter in the global.ini configuration file specifies the path to the keystore file that contains the certificates for the following internal communication channels:
- Communication between hosts
- Communication between sites in system replication scenarios (data communication channel).
The default value is $SECUDIR/sapsrv\_internal.pse .
## Related Information
Secure Internal Communication Between Sites in System Replication Scenarios [page 256]