## 10.4  Configure Secure Communication (TLS/SSL) Between Primary and Secondary Sites
Configure TLS/SSL on communication channels between primary and secondary systems using the system public key infrastructure (PKI).
## Prerequisites
- You have the credentials of the operating system user, &lt;sid&gt; adm.
- You have the system privilege INIFILE ADMIN.
## Context
The following communication channels between primary and secondary systems can be secured using TLS/ SSL:
- Metadata channel used to transmit metadata (for example, topology information) between the sites
- Data channel used to transmit data between the sites.
##  Note
On SAP HANA systems with dynamic tiering, the following steps also enable the system PKI for internal system replication communication. No additional steps are required. Before you configure communication for dynamic tiering see SAP Note 2447994 SAP HANA Dynamic Tiering Support for SAP HANA System Replication .
Be aware that you need additional licenses for SAP HANA options and capabilities. For more information, see Important Disclaimer for Features in SAP HANA Platform, Options and Capabilities .
## Procedure
1. Shut down all systems.
If you want to avoid downtime when enabling TLS/SSL, disable system replication. You can enable or disable TLS/SSL without downtime only if the primary system is not enabled.
2. In the primary and secondary system, enable TLS/SSL for the data channel.
In the global.ini file, configure the property [system\_replication\_communication] enable\_ssl . The following values are possible:
Value
## Description
| off (default)   | TLS/SSL is disabled for replication source and target systems   |
|-----------------|-----------------------------------------------------------------|
| on              | TLS/SSL is enabled for replication source and target systems    |
##  Note
You must enable SSL for the whole system, that is, in the global.ini file of the system database. Setting this feature for single tenant databases is not supported.
For a simple system replication scenario involving two systems, it is sufficient to set the property to on in both systems.
For multitier and multitarget system replication scenarios involving three systems, you can apply on in all 3 systems to secure all system replication connections. Alternatively, you can use site\_name as index to secure either only the communication to the tier 3 secondary system or only the communication to the primary system.
##  Example
To exclude the communication between the primary and the secondary, and to secure the communication between all other systems, set the parameter as follows:
```
siteA        ------>        siteB         ------>          siteC enable_ssl=on                enable_ssl=on
```
```
enable_ssl=on enable_ssl[siteB]=off        enable_ssl[siteA]=off
```
##  Note
To avoid communication failure between systems, TLS/SSL must be enabled on all systems at the same time. TLS/SSL won't be used unless the secondary system reconnects with the primary. To do this either restart the primary and secondary systems, or re-setup system replication .
3. As &lt;sid&gt; adm, restart the sapstartsrv service on the secondary system(s):
- a. sapcontrol -nr &lt;instance\_no&gt; -function StopService
- b. /usr/sap/&lt;sid&gt;/HDB&lt;instance\_no&gt;/exe/sapstartsrv pf=/usr/sap/&lt;sid&gt;/SYS/ profile/&lt;sid&gt;\_HDB&lt;instance\_no&gt;\_&lt;host&gt; -D -u &lt;sid&gt;adm
4. Restart all systems.
## Related Information
SAP Note 2447994 - SAP HANA Dynamic Tiering Support for SAP HANA System Replication