Setup Certificate-Based API Authentication

Prerequisites

  • SAP S/4HANA Public Cloud tenant
  • SAP Identity Authentication Service (IAS)
  • OpenSSL (or Windows Certificate Manager)
  • Postman

Step 1: Create a Certificate in SAP IAS

  1. Open your SAP IAS (Cloud Identity Service) tenant.
  2. Navigate to the certificate management section. Applications -> Choose your Test Tenant -> Under Trust Tab Click on Client Authentication
  3. Create a new client certificate.
  4. Export the certificate package as a .p12 (PKCS#12) file. (It should trigger the download automatically – Check your default download folder)

The exported .p12 file contains:

  • Public certificate
  • Private key

Keep this file secure. Make sure to save the password for your certificate

Step 2: Extract the Public Certificate

SAP Communication Users require only the public certificate.

Option A: Using OpenSSL

Extract the public certificate from the .p12 file:

openssl pkcs12 -in client.p12 -clcerts -nokeys -out client.crt

Enter the password used when exporting the .p12.

This creates:

client.crt

Option B: Using Windows Certificate Manager

  1. Double-click the .p12 file.
  2. Import it into the Current User certificate store.
  3. Open:
certmgr.msc
  1. Navigate to:
Personal → Certificates
  1. Locate the imported certificate.
  2. Right-click → All Tasks → Export.
  3. Select:
No, do not export the private key
  1. Choose:
Base-64 encoded X.509 (.CER)
  1. Save the file as:
client.cer

You may optionally rename it to:

client.crt

Step 3: Create the Communication User

In SAP S/4HANA Public Cloud:

  1. Open SAP Fiori App “Maintain Communication User”
  2. Create new

    Step 4: Create the Communication System

    Open Fior

    1. Create a new communication system.
    2. Enable inbound communication.
    3. Assign the communication user created in the previous step.
    4. Save the communication system.

    Step 5: Create the Communication Arrangement

    1.  
    2. Create a new arrangement using the required communication scenario.
    3. Assign the communication system.
    4. Activate the inbound service.
    5. Save the arrangement.

    The arrangement provides the API endpoint URL that will be used by API consumers.

    Bonus: Testing with Postman

    Configure the Client Certificate

    Open:

    Settings → Certificates

    Create a new certificate entry:

    Host: <your-tenant>-api.s4hana.cloud.sap
Port: 443

    Upload:

    client.p12

    Enter the password used during export.

    Do not upload:

    • .crt
    • .key

    The .p12 file already contains everything Postman requires.

    Send a Test Request

    Example:

    GET https://<your-tenant>-api.s4hana.cloud.sap/sap/opu/odata4/...
Accept: application/json

    For the initial test:

    • Remove Authorization headers
    • Remove OAuth configuration
    • Remove Basic Authentication
    • Remove cookies
    • Remove CSRF token headers

    Expected Results

    Successful certificate authentication typically returns:

    • HTTP 200 (Success)
    • HTTP 403 (Authenticated but missing authorization)
    • OData business errors

    These responses indicate that certificate authentication succeeded.

    Common errors:

    HTTP 401 Unauthorized

    The communication user or arrangement is not configured correctly.

    SSLV3_ALERT_CERTIFICATE_UNKNOWN

    The certificate sent by the client is not trusted or does not match the certificate uploaded to the communication user.

    ECONNRESET

    The TLS handshake failed before authentication completed.

    Troubleshooting Checklist

    ✓ Communication User uses “SSL Client Certificate”

    ✓ Correct public certificate uploaded

    ✓ Communication System references the correct communication user

    ✓ Communication Arrangement uses the correct communication system

    ✓ Postman sends the matching .p12 file

    ✓ API endpoint uses the -api.s4hana.cloud.sap hostname

    ✓ No conflicting Basic Authentication or OAuth configuration

    One additional tip from our troubleshooting session: if you receive SSLV3_ALERT_CERTIFICATE_UNKNOWN, the problem is usually not Postman. It almost always means the certificate uploaded to the Communication User does not match the certificate being sent by the client.