"Generate and manage client certificates in SAP BTP Enable certificate-based authentication and extend the SAP AI Core integration with mTLS Update the ISLM reuse connection in SAP S/4HANA to use mTLS"

"What do I need before I start?"

" You have access to an SAP BTP subaccount with administrative permissions You have completed the tutorial Set Up SAP BTP and Integrate SAP AI Core with ISLM "

Enhance ISLM Connectivity to SAP AI Core with mTLS

Enable certificate-based authentication for Intelligent Scenario Lifecycle Management (ISLM) to communicate with SAP AI Core.

🎓intermediate ⏱25 min SAP S 4hana Intermediate Artificial Intelligence SAP Ai Core 0/12

Overview

🎓 intermediate ⏱ 25 min. SAP S 4hanaIntermediateArtificial IntelligenceSAP Ai Core

You will learn

✔Generate and manage client certificates in SAP BTP
✔Enable certificate-based authentication and extend the SAP AI Core integration with mTLS
✔Update the ISLM reuse connection in SAP S/4HANA to use mTLS

D Daniel Funkert April 28, 2026

Created by April 28, 2026

Contributors

Prerequisites

You have access to an SAP BTP subaccount with administrative permissions
You have completed the tutorial Set Up SAP BTP and Integrate SAP AI Core with ISLM

Steps

Open all Close all

Step 1 Overview

—

In this tutorial, you enhance the authentication of Intelligent Scenario Lifecycle Management (ISLM) with mutual TLS (mTLS) for communication with SAP AI Core. You configure certificate-based authentication, create the required service bindings, and update the communication setup in SAP S/4HANA.

This tutorial demonstrates a generic approach. You can also use your own public key infrastructure (PKI) if your certificates are issued by a trusted certificate authority supported by SAP BTP.

The diagram illustrates how ISLM is embedded in the overall architecture and how it connects to SAP AI Core. This tutorial focuses on the SAP S/4HANA and SAP BTP components highlighted in the diagram.

Further Information:

Learn more about Intelligent Scenario Lifecycle Management (ISLM) on SAP Help Portal: Intelligent Scenario Lifecycle Management
Explore additional resources in the SAP Community: Intelligent Scenario Lifecycle Management for SAP S/4HANA
Review supported certificate authorities for mTLS: Trusted Authorities for X.509 Certificates

Step 2 Generate a Client Certificate in SAP BTP

Step 3 Create a Destination Service Instance for API Access

Step 4 Download the Client Certificate using the Destination Service API

In this step, you use the Destination Service REST API to download the client certificate along with its private key, and prepare it for use in SAP S/4HANA.

1. Open Bruno (or Postman) and choose Create Collection.

💡 TIP: If you already created the collection in the previous tutorial, continue with step 3.

2. Enter a Name for the collection, for example ISLM Tutorial and choose Create.

3. In the new collection, choose … next to the collection name and select New Request.

4. In the New Request dialog, maintain the following values [1] and choose Create [2]:

Type: HTTP
Name: Enter a name, for example Read Destination Certificate
HTTP Method: GET
URL: Use the uri value from the service binding and append /destination-configuration/v1/subaccountCertificates/<cert>

5. In the Request, open the Auth tab and select OAuth 2.0.

6. Maintain the following OAuth 2.0 values:

Grant Type: Client Credentials
Access Token URL: Use the url value from the service binding and append /oauth/token
Client ID: Enter the clientid value from the service binding
Client Secret: Enter the clientsecret value from the service binding

7. Choose Get Access Token [1]. After a few seconds, the token is fetched [2] and displayed. Choose Save.

ℹ️ NOTE: The access token is used to authenticate when calling the SAP AI Core API.

8. Choose Execute to send the request.

9. After a few milliseconds, the response is returned and displayed in the Response section. Copy the value of the Content field and paste it into a local text file, for example client_certificate_base64.txt.

10. Decode the Base64 content and save it as a PEM file, for example client_certificate.pem. You can use the following command:

macOS (Terminal)

Shell

base64 -d -i client_certificate_base64.txt -o client_certificate.pem

Windows (PowerShell)

PowerShell
$base64 = Get-Content client_certificate_base64.txt
$bytes  = [System.Convert]::FromBase64String($base64)
Set-Content client_certificate.pem -Value $bytes -Encoding Byte

11. Congratulations! You have successfully downloaded and prepared the client certificate for SAP S/4HANA.

Step 5 Import the Client Certificate into SAP S/4HANA

Step 6 Export Public Certificate from ISLM Keystore for mTLS

Step 7 Create an SAP AI Core Service Binding with mTLS Authentication

In this step, you create an additional SAP AI Core service binding for mTLS. You use the public certificate to establish trust and enable certificate-based authentication in the binding parameters.

1. The public certificate extracted in the previous step must be converted into a single-line format before it can be used in the service binding configuration. Convert the certificate as follows:

macOS (Terminal)

Shell
tr -d '\r' < DEV.cer | sed 's/$/\\n/' | tr -d '\n'; echo

Windows (PowerShell)

PowerShell
(Get-Content DEV.cer -Raw) -replace "`r?`n", "\n"

2. Copy the resulting string. You will use it later in the binding payload.

3. Log on to your SAP BTP subaccount and open Services > Instances and Subscriptions.

BTP Cockpit: Instances and Subscriptions

4. For your existing SAP AI Core service instance, choose … > Create Service Binding.

5. In the New Binding dialog, enter an Instance Name, for example api-binding-mtls.

6. Specify the following JSON in the Configure Binding Parameters section. Replace <paste your converted public certificate here> with the converted certificate string from step 1:

JSON
{
  "xsuaa": {
  	"credential-type": "x509",
    "x509": {
      "certificate": "<paste your converted public certificate here>",
      "ensure-uniqueness": false,
      "certificate-pinning": false,
      "hide-certificate": true
    }
  }
}