## 10.1 Secure Internal Communication
All internal SAP HANA communication can be secured using the Transport Layer Security (TLS)/Secure Sockets Layer (SSL) protocol. A simple public-key infrastructure (PKI) is set up during installation for this purpose.
## Internal Communication Channels
The internal communication channels shown below can be secured using TLS/SSL.
##  Note
SAP HANA internal communication has sometimes been unofficially referred to as TREXNet communication. However, the term TREXNet is not valid in the context of SAP HANA.
## Communication between databases
<!-- image -->
## Communication between the hosts in a multiple-host system and between processes on a single host
<!-- image -->
<!-- image -->
## Communication between the sites in a system with system replication enabled
<!-- image -->
## Communication between the SAP HANA database and additional server components
For example: Extended storage server (SAP HANA dynamic tiering) or a streaming analytics server (SAP HANA Streaming Analytics).
<!-- image -->
## System Public Key Infrastructure
A dedicated PKI is created for internal communication automatically during system installation. Every host on which a database server and optional component server is running, as well as every tenant database in the system, are integrated into this PKI, which uses CommonCryptoLib as the cryptographic library.
Each host and database receive a public and private key pair and a public-key certificate for mutual authentication. These certificates are all signed by a dedicated trusted certificate authority (CA) that is unique to the SAP HANA instance. The root personal security environment (PSE) file is stored in the system PKI SSFS (secure store in the file system). All other PSEs are encrypted with an automatically generated random PIN and stored in the file system. Certificates are automatically renewed when they expire.
##  Note
A unique master key that protects the system PKI SSFS is generated during installation or update. However, if you received your system pre-installed from a hardware or hosting partner, we recommend that
you change it immediately after handover to ensure that it is not known outside of your organization. For more information about how to change the SSFS master keys, see the SAP HANA Administration Guide .
To secure internal communication between hosts and sites, you can set up and configure your own PKI, but we recommend you use the system PKI. The system PKI is always used to secure communication within tenant databases and communication with optional server components.
##  Note
If high isolation is configured for tenant databases, the system PKI must also be used to secure communication between hosts.
For more information about migrating to the system PKI from a manually configured PKI, see SAP Note 2175672.
## TLS/SSL Configuration Using System PKI
No interaction is required to set up the system PKI, but you may need to explicitly enable TLS/SSL depending on the channel as follows:
| Communication Channel                                       | Configuration Required to Enable TLS/SSL                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
|-------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Communication between the processes of individual databases | Configure the system for high isolation. High isolation requires that the processes of individual databases run under dedi­ cated operating system (OS) users in dedicated OSgroups. In addition, it enables certificate­based authentication so that only the processes belonging to the same database can communicate with each other. If you also want data communication within databases to be encrypted, you must change the value of the property [communication] ssl in the global.ini from off to systemPKI . If the property ssl is not visible (for example, in the SAP HANAstudio), add the key ssl with the value systemPKI to the section communication . |
| Communication between the processes of individual databases |  Remember Change (or add) the property in the system database in the SYSTEM layer of the configuration file.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
| Communication between the processes of individual databases |  Note If cross-database access is enabled, communication between configured ten­ ant databases is allowed.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Communication between the processes of individual databases | For more information about how to configure a system for high isolation, see the SAP HANAAdministration Guide .                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Communication Channel                                                             | Configuration Required to Enable TLS/SSL                                                                                                                                                                                                                                                               |
|-----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Communication between hosts in a multiple-host system and localhost communication | Enable TLS/SSL manually. In the global.ini configuration file, change the value of the property [communication] ssl to systemPKI . This configuration ensures that only hosts belonging to the same system can communicate with each other and that all data communication between hosts is encrypted. |
| Communication between hosts in a multiple-host system and localhost communication |  Note In a system that is not configured for high isolation, you can still enable se­ cure communication between hosts. Remember you change the property in the system database in the SYSTEM layer.                                                                                                   |
| Communication between hosts in a multiple-host system and localhost communication | secure communication between hosts automatically enables secure between processes on the same host without any further config­ uration. Note the following:                                                                                                                                             |
| Communication between hosts in a multiple-host system and localhost communication | Enabling communication                                                                                                                                                                                                                                                                                 |
| Communication between hosts in a multiple-host system and localhost communication | ● If you are operating a single-host and require secure localhost communica­ tion, you must still enable TLS/SSL for inter-host communication as descri­ bed above. ● If you have enabled TLS/SSL for inter-host communication as described                                                              |
| Communication between sites in a sys­ tem with system replication enabled          | Several steps are required to enable TLS/SSL for the communication channel used for system replication. For more information, see Secure Internal Communi­ cation Between Sites in System Replication Scenarios .                                                                                       |
| Communication between the SAP HANAdatabase and additional server components       | No configuration required TLS/SSL is automatically enabled and cannot be disabled.                                                                                                                                                                                                                     |
## Related Information
Secure Stores in the File System (SSFS) Change the SSFS Master Keys Database Isolation Increase the System Isolation Level Server-Side TLS/SSL Configuration Properties for Internal Communication Secure Internal Communication Between Sites in System Replication Scenarios [page 256] Legacy Configuration of Secure Internal Communication [page 257]
SAP Note 2175672